Security Architecture
Threat modeling, control mapping, and zero-trust patterns for workloads that carry real consequence.
§ 01 — Position
Security architecture in a regulated estate is not primarily a technical problem. The controls are mostly known and mostly available. The difficulty is demonstrating that they are in place, that they were in place last quarter, and that someone with authority reviewed the exceptions.
That shifts the design question. Not only what protects the workload, but what evidence the design produces as a by-product — because evidence assembled retrospectively is expensive, contested, and often unconvincing.
§ 02 — Method
- 01
Threat model against the actual system
Including the parts nobody wants to discuss: the service account with standing access, the exception granted for a migration that finished two years ago, the integration built in a hurry.
- 02
Map controls to obligations, not to a framework
Frameworks are a useful checklist and a poor design input. Starting from the specific obligations that apply produces a smaller, more defensible control set than starting from a standard and pruning.
- 03
Design evidence as an output
If demonstrating a control requires someone to assemble screenshots, that control will be demonstrated badly. Logging, attestation, and reporting belong in the design.
- 04
Give exceptions expiry dates
An exception with a review date is a plan. An exception without one is a permanent hole that someone will eventually find.
§ 03 — Deliverables
- Threat model covering the system as deployed
- Control mapping against applicable obligations
- Zero-trust design for identity, network, and data boundaries
- Evidence and attestation design
- Exception register with review schedule
- Agentic and non-human identity boundaries
- Architecture decision records for every significant choice
§ 04 — Fit
Best whenAn audit is approaching, or a workload is moving into scope of an obligation it was not designed for.
Not forPenetration testing or incident response. Both are specialist disciplines with specialist providers.
§ 05 — Field notes
§ 06 — Other practices
An audit is approaching, or a workload is moving into scope of an obligation it was not designed for.
Start a conversation