Security Architecture
Think in threats and trust boundaries rather than in security products.
20 topics in this area.
Each topic is the unit content is filed against. Topics with nothing in them yet are shown too — they are the honest edge of the curriculum rather than a gap being hidden.
Security Architecture
General material on securing an architecture.
Authentication
Establishing who a principal is, and how strong that claim needs to be.
No content yetAuthorization
RBAC, ABAC and ReBAC, and centralising the decision but not the enforcement.
No content yetOAuth 2.0 & OIDC
Delegated authorisation, and the identity layer that makes login safe.
No content yetTokens & JWTs
Stateless validation, revocation, and pinning the algorithm.
No content yetIdentity & Access Management
Workload identity, roles, permission boundaries and usage-based review.
No content yetSecrets Management
Runtime injection, dynamic credentials and rotation applications survive.
No content yetEncryption
At rest, in transit, and at the application layer — three different threats.
No content yetKey Management
Rotation, separation of duty, envelope encryption and crypto-shredding.
No content yetZero Trust
No implicit trust from network position; authorise every request.
No content yetThreat Modelling
Walking trust boundaries with STRIDE before anything is built.
No content yetOWASP Risks
The recurring web and API risk classes, several of which are design flaws.
No content yetSecure API Design
Object-level authorisation, input validation and safe error responses.
No content yetSupply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
No content yetNetwork Security
Segmentation, egress control and limiting lateral movement.
No content yetAuditability
Tamper-evident, attributed records that survive async boundaries.
No content yetCompliance Frameworks
SOC 2, ISO 27001, PCI DSS — scope as an architectural lever.
No content yetPrivacy Engineering
Minimisation, purpose limitation, and erasure that is implementable.
No content yetData Classification
Knowing which fields are regulated, because every control depends on it.
No content yetSecurity Incident Response
Detection, scoping, containment and notification clocks.
No content yet