Security Architecture and Infrastructure Concepts

Responsibility Matrix

Defines the division of responsibilities between the cloud service provider and the customer regarding security, compliance, and management of resources.

Hybrid Considerations

Strategies and challenges involved in integrating on-premises infrastructure with cloud services.

Third-party Vendors

Incorporating services and solutions from external providers into cloud architectures.

Infrastructure as Code (IaC)

Automating the provisioning and management of infrastructure using code and configuration files.

Serverless

Architectural approach where cloud providers manage the infrastructure, allowing developers to focus solely on writing and deploying code.

Microservices

Architectural style where applications are composed of small, independently deployable services, promoting modularity and scalability.

Physical Isolation

Creating network segments physically separated from other parts, often for security or regulatory compliance reasons (e.g., air-gapped networks).

Logical Segmentation

Dividing networks into logical segments using techniques such as VLANs or software-defined networking (SDN).

Software-defined Networking (SDN)

Managing network infrastructure programmatically through software, abstracting the underlying hardware.

On-premises

Infrastructure and services hosted within an organization's physical facilities rather than in the cloud.

Centralized vs. Decentralized

Contrasting approaches to organizing infrastructure management and decision-making authority.

Containerization

Encapsulating applications and their dependencies into lightweight, portable containers for deployment across different environments.

Virtualization

Creating virtual instances of servers, operating systems, storage, or networks to maximize resource utilization and flexibility.

IoT (Internet of Things)

Network of interconnected devices that communicate and exchange data, often involving sensors, actuators, and embedded systems.

Industrial Control Systems (ICS) / Supervisory Control and Data Acquisition (SCADA)

Systems used to monitor and control industrial processes and critical infrastructure.

Real-time Operating System (RTOS)

Operating system optimized for handling real-time processing requirements, often used in embedded systems and IoT devices.

Embedded Systems

Computing devices with specialized functions and limited resources, embedded within larger systems or products.

High Availability

Design principle aiming to minimize downtime and ensure continuous operation of critical systems and services.

Availability

Ensuring systems and services are accessible and operational when needed.

Resilience

Ability to withstand and recover from disruptions, failures, or attacks.

Cost

Balancing infrastructure expenses with budgetary constraints and business needs.

Responsiveness

Ability to quickly adapt and scale infrastructure to meet changing demands.

Scalability

Capacity to expand or shrink resources in response to workload changes.

Ease of Deployment

Simplifying the process of deploying and configuring infrastructure components.

Risk Transference

Shifting security and operational risks to third-party service providers or insurance mechanisms.

Ease of Recovery

Simplifying and accelerating the restoration of services after disruptions or failures.

Patch Availability

Timely availability of software patches and updates to address vulnerabilities and improve security.

Inability to Patch

Addressing challenges associated with patching legacy or embedded systems that cannot be easily updated.

Power

Ensuring sufficient and reliable power supply to support infrastructure operations.

Compute

Managing computational resources to meet performance requirements and optimize resource utilization.

Device Placement

Strategic positioning of network devices and assets to optimize performance, security, and accessibility.

Security Zones

Segregation of network resources into distinct zones based on security requirements and trust levels.

Attack Surface

Total sum of vulnerabilities and entry points that attackers can exploit to compromise a system or network.

Connectivity

Establishing reliable connections between network components while considering bandwidth, latency, and reliability.

Fail-Open

Devices or systems that default to an open state when they encounter a failure, potentially exposing the network to risks.

Fail-Closed

Devices or systems that default to a closed or secure state when they encounter a failure, preventing unauthorized access.

Active vs. Passive

Active devices perform actions on data packets (e.g., firewalls), while passive devices observe and analyze network traffic (e.g., network monitoring tools).

Inline vs. Tap/Monitor

Inline devices sit directly in the data path and can actively intercept or modify traffic, whereas tap/monitor devices passively monitor traffic without interrupting the flow.

Jump Server

Intermediate server used to access and manage devices in a separate, more secure network segment.

Proxy Server

Intermediary server that acts as an intermediary between clients and other servers, providing various functionalities such as caching, filtering, and anonymization.

Intrusion Prevention System (IPS) / Intrusion Detection System (IDS)

Security appliances designed to monitor network traffic for suspicious activity and take action to prevent or mitigate attacks.

Load Balancer

Device that distributes incoming network traffic across multiple servers to optimize resource utilization, improve scalability, and enhance reliability.

Sensors

Devices that collect data from the environment or network for monitoring and analysis, often used for security monitoring and threat detection.

802.1X

IEEE standard for port-based network access control, allowing authentication and authorization of devices before granting access to the network.

Extensible Authentication Protocol (EAP)

Framework for network authentication methods used in 802.1X and other authentication protocols.

Web Application Firewall (WAF)

Firewall specifically designed to protect web applications from common web-based attacks.

Unified Threat Management (UTM)

Comprehensive security appliance that combines multiple security features such as firewall, antivirus, intrusion detection, and content filtering into a single platform.

Next-Generation Firewall (NGFW)

Firewall appliance that integrates traditional firewall capabilities with advanced security features like application awareness, intrusion prevention, and deep packet inspection.

Layer 4/Layer 7

Classifies firewalls based on the layers of the OSI model they operate at, with Layer 4 firewalls filtering traffic based on IP addresses and port numbers, while Layer 7 firewalls can inspect and filter traffic based on application-layer data.

Virtual Private Network (VPN)

Secure encrypted tunnel that allows remote users to securely access the organization's network resources over the internet.

Remote Access

Provision of secure access to network resources for users located outside the organization's premises.

Transport Layer Security (TLS)

Protocol that provides secure communication over a computer network, commonly used for securing web traffic.

Internet Protocol Security (IPSec)

Suite of protocols for securing IP communications by authenticating and encrypting each IP packet of a data stream.

Software-Defined Wide Area Network (SD-WAN)

Approach to network connectivity that uses software-defined networking (SDN) to intelligently route traffic across the WAN, optimizing performance and reducing costs.

Secure Access Service Edge (SASE)

Converged networking and security architecture that combines WAN capabilities with cloud-native security functions to support secure remote access and direct-to-cloud connectivity.

Selection of Effective Controls

Choosing and implementing security controls based on risk assessments, compliance requirements, organizational needs, and industry best practices to mitigate threats and vulnerabilities effectively.

Data Types

Categories of data characterized by their regulatory requirements and sensitivity.

Regulated Data

Data subject to specific laws and regulations governing its collection, storage, processing, and sharing, such as personal health information (PHI) under HIPAA or financial data under PCI DSS.

Trade Secret

Proprietary information that provides a competitive advantage to a business and is protected by intellectual property laws.

Intellectual Property

Creations of the mind, such as inventions, literary and artistic works, designs, symbols, and trade secrets, protected by copyright, patents, and trademarks.

Legal Information

Data related to legal matters, including contracts, litigation documents, and attorney-client privileged communications.

Financial Information

Data concerning financial transactions, accounts, investments, and assets, which may include personally identifiable information (PII) and payment card data.

Human- and Non-Human-Readable Data

Data formats that can be understood by humans (e.g., text, images) and those intended for machine processing (e.g., binary, encrypted data).

Data Classifications

Categories that define the sensitivity and handling requirements of data.

Sensitive Data

Data that requires protection due to its sensitivity and potential impact on individuals, organizations, or society if compromised.

Confidential Data

Data that should be kept private and disclosed only to authorized individuals or entities, often subject to confidentiality agreements or laws.

Public Data

Data intended for unrestricted access and sharing, typically non-sensitive information that can be freely distributed.

Restricted Data

Data with limited access based on specific criteria or authorization requirements, often containing sensitive or confidential information.

Private Data

Data designated for internal use within an organization and not intended for public disclosure.

Critical Data

Data essential to the operation or mission of an organization, the loss or compromise of which could have severe consequences.

Data States

Different conditions in which data can exist.

Data at Rest

Data stored in databases, files, or other storage systems.

Data in Transit

Data being transmitted over a network or communication channel.

Data in Use

Data actively being processed or accessed by applications or users.

Data Sovereignty

Legal concept specifying the jurisdiction under which data is subject to the laws and regulations of a particular country or region.

Geolocation

Identification of the physical location or origin of data, which may have implications for data privacy, security, and compliance.

Methods to Secure Data

Techniques employed to protect data from unauthorized access and breaches.

Geographic Restrictions

Limiting access to data based on the geographic location of users or devices.

Encryption

Converting data into a ciphertext format using cryptographic algorithms to prevent unauthorized access.

Hashing

Generating a unique fixed-size string (hash value) from data input, commonly used for data integrity verification.

Masking

Concealing specific portions of data to prevent unauthorized disclosure while maintaining usability for authorized purposes.

Tokenization

Substituting sensitive data with a non-sensitive equivalent (token) that retains the format and length of the original data but has no exploitable value.

Obfuscation

Intentionally obscuring or hiding data to make it unintelligible or harder to interpret for unauthorized parties.

Segmentation

Dividing networks or systems into isolated segments to contain the spread of threats and limit unauthorized access.

Permission Restrictions

Applying access controls and permissions to data based on user roles, privileges, or other criteria to enforce the principle of least privilege.

Load Balancing

Distributing incoming network traffic across multiple servers to optimize resource utilization, maximize throughput, and ensure high availability.

Clustering

Connecting multiple independent servers or nodes to work together as a single system, providing redundancy and fault tolerance.

Hot Site

Fully equipped facility with infrastructure and systems ready to be operational within a short time frame after a disaster.

Cold Site

Facility lacking pre-installed infrastructure and systems, requiring setup and configuration before becoming operational after a disaster.

Warm Site

Partially equipped facility with some infrastructure and systems in place, reducing the time required for setup compared to a cold site.

Geographic Dispersion

Spreading critical infrastructure and resources across multiple locations to minimize the impact of regional disasters or disruptions.

Platform Diversity

Utilizing a variety of hardware, software, and cloud platforms to mitigate the risk of single points of failure and enhance overall system resilience.

Multi-cloud Systems

Deploying applications and services across multiple cloud providers to increase redundancy, avoid vendor lock-in, and enhance flexibility and resilience.

Continuity of Operations

Ensuring the uninterrupted availability of critical business functions and processes during and after disruptive events or disasters.

Capacity Planning

Assessing and allocating resources to meet current and future demands, including hardware, software, and network infrastructure.

Tabletop Exercises

Simulated discussions and walkthroughs of disaster scenarios to evaluate preparedness, identify gaps, and refine response plans.

Failover

Testing the automatic or manual transfer of operations from a primary to a secondary system or site to ensure continuity.

Simulation

Emulating real-world scenarios to assess the effectiveness of disaster recovery and business continuity plans.

Parallel Processing

Executing tasks simultaneously across multiple systems or nodes to improve performance and resilience.

Backups

Storing backup copies of data and systems either onsite (within the same physical location) or offsite (at a separate location).