Architecture, Decisions, Security Trade-offs, and Risk

What is cybersecurity architecture?

The arrangement of systems, data, users, controls, and connections that determines exposure, access, trust, and evidence.

Why is an architecture decision also a risk decision?

Changing data placement, access, or workflows changes exposure, security requirements, and potential risk.

What are the four main architecture design considerations?

Data placement, access paths, trust boundaries, and monitoring or evidence.

What is data placement?

Where information is stored, which affects who can reach it and how it must be protected.

What are access paths?

Ways users or systems reach resources, such as login pages, VPNs, APIs, shared links, and vendor connections.

What are trust boundaries?

Points between users, departments, networks, vendors, or cloud services where security controls change.

Why are monitoring points important in architecture?

They provide logs and evidence to detect, investigate, and understand system activity.

What is a benefit and risk of centralizing data?

Benefit: easier administration; Risk: one compromise may expose more records.

What is a benefit and risk of remote access?

Benefit: work from anywhere; Risk: additional access paths attackers can target.

What is a benefit and risk of vendor integration?

Benefit: faster service delivery; Risk: third-party access and dependency.

What is a benefit and risk of increased logging?

Benefit: greater visibility; Risk: privacy concerns and storage burden.

What are the four lenses for evaluating architecture risk?

Asset value, exposure, control strength, and usability impact.

What is asset value in architecture risk evaluation?

The importance of the system or data and the harm caused if it is exposed, altered, or unavailable.

What is exposure?

Who can reach a system or its data, including internal, public, vendor, or cloud access.

What is control strength?

How effectively security measures prevent, detect, or correct misuse, including whether they are enforced.

What is usability impact?

How security requirements affect users' ability to complete work and whether they encourage workarounds.

What is the main goal of balancing security and usability?

Provide appropriate protection while allowing users to perform their responsibilities effectively.

What are the risks of a system that is too open?

High exposure, weak oversight, and increased opportunities for misuse.

What are the risks of a system that is too restrictive?

Work delays, unsafe shortcuts, shared accounts, and shadow processes.

What is security friction?

Difficulty caused by security controls, such as excessive approvals, lockouts, or confusing access paths.

How can security friction create new vulnerabilities?

Users may bypass controls through shared accounts, personal storage, screenshots, or unauthorized processes.

What is the security friction cycle?

Friction → Workaround → Risk → Fix.

What is the practical design rule for secure workflows?

The secure path should be easier than the unsafe workaround.

What is role-based access in architecture design?

Providing different access permissions based on users' job responsibilities.

Why is role-based access often preferred over broad access or strict approval?

It balances job-appropriate permissions, service efficiency, accountability, and manageable security controls.

What five elements are evaluated in the practical architecture risk method?

Asset, exposure, controls, usability, and residual risk.

What should be considered when evaluating an asset?

What system, data, service, or process is affected and which CIA objective matters most.

What is inherent risk?

The risk that exists before security controls are applied.

What is residual risk?

The risk that remains after security controls have been implemented.

Can security controls eliminate all architecture risk?

No. Some residual risk remains and must be understood, monitored, and accepted.

Who should accept residual risk?

The appropriate organizational decision maker or risk owner.

What evidence can help evaluate a new access-control design?

Access reviews, audit logs, failed login records, lockout data, and support tickets.

What is a balanced response to stronger login controls causing delays?

Use risk-based verification, role-based access, clear lockout recovery, and monitoring of login failures and support requests.

What is the difference between broad access, role-based access, and strict approval?

Broad access is fast but exposes more data; role-based access matches duties; strict approval restricts access but creates delays.

What is control without evidence?

A security control exists, but the organization cannot prove whether it worked or was bypassed.

What is outsourcing without oversight?

Using a vendor or cloud service without clearly defining responsibilities and required evidence.

What is risk without ownership?

Residual risk exists without an identified decision maker responsible for accepting it.

What are the four stages of a defensible architecture decision?

Classify → Evaluate → Recommend → Accept.

What should a strong architecture recommendation explain?

The chosen design, specific risk reduction, preserved service needs, remaining risk, and evidence to monitor.

What is the main takeaway about secure architecture?

Security depends on design, controls, evidence, and user workflows working together.