Security Architecture: Defense in Depth and Zero Trust

About this article

This article is the first article in the “Security Architecture” category of the Architecture Crash Course for the Generative-AI Era series. It covers the big picture of security architecture.

Security is a design domain that cannot be bolted on later. This article surveys the CIA triad, the major domains (auth, authorization, encryption, network, secrets management, audit), the shift from perimeter defense to Zero Trust, and the AI-era stance: delegate security.

A full list of all articles in this category, with summaries and learning points, is available at the following page.

Security Architecture — Article Indexen.senkohome.com/arch-intro-index-security/

What is security architecture in the first place

Imagine home security. Door locks, anti-burglary window film, security cameras, fire alarms — no single measure is enough; defending in multiple layers is the foundation of security. What’s more, adding foundational security after the house is built is extremely difficult.

Security architecture is the domain of designing authentication, authorization, encryption, network defense, secrets management, and audit logging in multiple layers. It must be built in from the start of design, not bolted on later.

Why it is treated as an architecture of its own

First, because the blast radius covers every system. Change the authentication platform, the encryption scheme or the permission model later and every application is affected. Second, because regulatory compliance is not optional. GDPR, data-protection law, PCI DSS, SOC 2 — the data you handle decides which regime you must satisfy, and a violation leads straight to criminal penalties and enormous damages. Third, because it is specialised work that cannot be done on the side.

Above all, data that has leaked once never goes back to being unpublished. A single hole leaks everything, and the damage is well past what an apology covers.

The three things to protect (CIA) and the main domains

The most-used framework in security architecture is CIA. Which of the three you prioritize most shifts the design axis.

Finance prioritizes confidentiality; public services prioritize availability. The weight changes by business characteristic — that’s the key point.

The shift in security thinking — from the perimeter to Zero Trust

The traditional model was perimeter defence — “the firewall guards the boundary, and the internal network is safe” — but remote work, cloud and SaaS blurred the boundary until that premise stopped holding.

Zero Trust is the philosophy of trusting neither inside nor outside the network and verifying authentication and authorization on every transaction. Google’s BeyondCorp, implemented during the 2010s, was the forerunner. Rather than guarding a perimeter with a VPN, you continually verify user, device and context — an identity-centric design, and the largest paradigm shift of the cloud era.

How to proceed — a phased adoption roadmap

“Everything at once” is unrealistic for security, so what is mandatory and what is recommended are split by phase.

“Even at MVP, MFA, Dependabot, Secret Scanning and HTTPS are all mandatory.” Put those off and within hours of launch you are hit by leaked IAM keys or intrusion through a dependency. Log4Shell in 2021 and the Okta and LastPass incidents in 2022 showed what that costs.

Knowledge structure of this category

This category is composed of 8 articles in total. The security design domains are learned in four stages: “who?” -> “what can they do?” -> “how to protect?” -> “how to detect?”

Identity (Group 1) first designs authentication — “who are you?” — and authorization — “what can you do?”. Authentication and authorization are often confused but are completely separate design decisions.

Protection (Group 2) designs transport encryption, network perimeter, Zero Trust, and secrets management with identity confirmed as the premise. These four articles are fairly independent, so you can read whichever you need first.

Detection (Group 3) — vulnerability assessment — is about building a system that keeps hunting for holes on top of the defenses. Security is never “design once and done”; continuous detection is indispensable.

AI decision axes — Do not write it, borrow it, and watch it

Vulnerability patterns that creep into AI-generated code

Code an AI generates carries security problems at some rate. The common ones are string concatenation in SQL queries (parameter binding skipped), missing sanitisation of user input (XSS), and absent authorization checks (an API with authentication and no authorization). These follow from the AI prioritising “code that works.” The countermeasure is to put SAST (Semgrep, CodeQL) into the CI pipeline and scan every push automatically, AI-generated code included.

Delegating security pays twice over in the AI era

Handing authentication to Auth0 or Clerk, the WAF to Cloudflare and encryption to KMS — the “don’t write it, borrow it” policy — carries a second benefit in the AI era. Whatever you delegate has its security patches applied continuously by the SaaS provider, so security debt does not accumulate in your own codebase and the range of security configuration the AI has to manage is kept to a minimum.

Pitfalls and forbidden moves

Of the forbidden moves covered in detail across the individual articles, here are the six that matter at the level of the whole.

Security is the three-part set: “do not write it, borrow it, watch it.” Building your own is the largest single source of incidents.

Author’s note — how a “preventable hit” tipped companies over

Security incidents come from neglected basics far more than from spectacular attacks. At one large credit bureau, a two-month delay in patching a known Apache Struts vulnerability in 2017 leaked the personal data of about 147 million people, and settlements and fines together swelled to roughly $700 million. In 2019 a large US financial services company leaked around 100 million customer records out of S3, starting from a WAF misconfiguration (SSRF), and took a fine on the order of $80 million.

Neither was an advanced zero-day; in both, “the basics of operations” had broken down. The unglamorous fundamentals — patching, MFA, configuration review — are the strongest defence there is.

What to decide — what is your project’s answer?

For each of the following, try to articulate your project’s answer in one or two sentences. Each is covered in detail in the individual articles beneath this one.

• Authentication method and platform (MFA / Passkey / IDaaS)
• Authorization model (RBAC / ABAC / ReBAC)
• Encryption and key management (TLS / KMS / secrets management)
• Network defence (WAF / Zero Trust)
• Audit logs and vulnerability management (SIEM / SAST / SBOM)
• Compliance (SOC 2 / ISO 27001 / PCI DSS)

Summary

This article covered the big picture of security architecture — the CIA basics, major domains, perimeter-to-Zero-Trust shift, phase-by-phase roadmap, and the AI-era delegation stance.

Delegate to standard protocols and dedicated SaaS, design for defense in depth, start from Zero Trust, keep everything IaC-described and reviewable. The realistic answer for 2026.

The next article covers authentication design (MFA, Passkey, SSO, IDaaS selection).

Back to series TOC -> ‘Architecture Crash Course for the Generative-AI Era’: How to Read This Book

I hope you’ll read the next article as well.