Security Architecture Overview — Defense in Depth and Zero Trust

About this article

This article is the first article in the “Security Architecture” category of the Architecture Crash Course for the Generative-AI Era series. It covers the big picture of security architecture.

Security is a design domain that cannot be bolted on later. This article surveys the CIA triad, the major domains (auth, authorization, encryption, network, secrets management, audit), the shift from perimeter defense to Zero Trust, and the AI-era stance: delegate security.

A full list of all articles in this category, with summaries and learning points, is available at the following page.

Security Architecture — Article Indexen.senkohome.com/arch-intro-index-security/

What is security architecture in the first place

Imagine home security. Door locks, anti-burglary window film, security cameras, fire alarms — no single measure is enough; defending in multiple layers is the foundation of security. What’s more, adding foundational security after the house is built is extremely difficult.

Security architecture is the domain of designing authentication, authorization, encryption, network defense, secrets management, and audit logging in multiple layers. It must be built in from the start of design, not bolted on later.

Without security architecture, all data leaks through a single hole, and leaked data never goes back to “private.” The damage goes beyond any apology.

Once leaked, data never goes back to “private”

Traditionally “firewalls protect the perimeter” was the central model, but the proliferation of remote work, cloud, and SaaS has blurred the perimeter, and Zero Trust (trust nothing, always verify) became the dominant philosophy.

Security is a design domain that cannot be bolted on later. Once data leaks, no apology brings it back.

Why treat it as a separate architecture

1. Impact reaches every system

Auth foundation, encryption methods, permission model — changing them later affects every application. Without deciding upstream, you face a total replacement later.

2. Compliance is mandatory

GDPR (EU’s General Data Protection Regulation), data protection laws, PCI DSS (credit card handling standard), SOC2 (cloud-provider internal control standard), etc. — depending on the data your system handles, specific regulations apply. Violations carry criminal penalties and massive damages.

3. Specialized; cannot be a side gig

Encryption, vulnerability assessment, SOC operations are specialist fields and cannot be done casually. Many orgs now have a dedicated security team (CSIRT — Computer Security Incident Response Team).

The three things to protect (CIA)

The most-used framework in security architecture is CIA. Which of the three you prioritize most shifts the design axis.

Finance prioritizes confidentiality; public services prioritize availability. The weight changes by business characteristic — that’s the key point.

Domain taxonomy

What you must decide — what’s your project’s answer?

For each item, articulate your project’s answer in 1-2 sentences.

AuthN / AuthZ / sessions

Encryption / key management

Network / audit / compliance

The shift in security philosophy

The migration from “perimeter defense” to “Zero Trust” is the largest paradigm shift of the cloud era. Perimeter design assumed “the internal network is safe”; remote work, SaaS use, and rising insider threats broke that assumption.

Zero Trust is the philosophy that trusts neither inside nor outside the network and verifies authentication and authorization on every transaction. Google’s BeyondCorp in the 2010s was the precursor. It bypasses VPN reliance and continually verifies user, device, and context.

Phase-by-phase security adoption roadmap

“Everything at once” is unrealistic. Split required vs recommended by phase.

“Even at MVP, MFA + Dependabot + Secret Scanning + HTTPS are mandatory.” Postpone these and within hours of public launch you face IAM key leaks and intrusion via dependencies. The 2021 Log4Shell and 2022 Okta / LastPass incidents demonstrated the cost.

Even at MVP, install the minimum 4 on day one. “Later” does not exist in security.

Knowledge structure of this category

This category is composed of 8 articles in total. The security design domains are learned in four stages: “who?” -> “what can they do?” -> “how to protect?” -> “how to detect?”

Identity (Group 1) first designs authentication — “who are you?” — and authorization — “what can you do?”. Authentication and authorization are often confused but are completely separate design decisions.

Protection (Group 2) designs transport encryption, network perimeter, Zero Trust, and secrets management with identity confirmed as the premise. These four articles are fairly independent, so you can read whichever you need first.

Detection (Group 3) — vulnerability assessment — is about building a system that keeps hunting for holes on top of the defenses. Security is never “design once and done”; continuous detection is indispensable.

Architecture-level traps

Security is the three-set: “don’t write it, borrow it, watch it.” Custom implementation is the largest source of incidents.

AI decision axes

1. Delegate to standard protocols and dedicated SaaS — don’t DIY auth, authorization, or encryption
2. Design for defense in depth — stack network, auth, and encryption rather than relying on a single measure
3. Start from Zero Trust — drop “inside is safe” and verify auth/authz on every transaction
4. Express in IaC, keep it reviewable — avoid GUI-set tribal permissions; leave a Git audit trail

Vulnerability patterns that creep into AI-generated code

AI-generated code has a certain probability of introducing security issues. The most common ones are: SQL query string concatenation (skipping parameter binding), insufficient sanitization of user input (XSS), and missing authorization checks (API endpoints with authentication only and no authorization).

These result from AI prioritizing “code that works,” not from intentionally writing vulnerable code. The countermeasure is adding SAST (Semgrep, CodeQL) to the CI pipeline to automatically scan all pushes, including AI-generated code.

”Delegating” security settings takes them outside AI’s management scope

Delegate auth to Auth0/Clerk, delegate WAF to Cloudflare, delegate encryption to KMS — this “don’t write it, borrow it” policy carries an additional benefit in the AI era. Delegated areas have the SaaS provider constantly applying the latest security patches, so security debt doesn’t accumulate in your codebase. It minimizes the range of security configuration that AI needs to manage.

Author’s note — incidents that toppled companies via “should-have-prevented” hits

You hear repeatedly that security incidents come from neglecting basics rather than fancy attacks.

A major US credit bureau in 2017 took 2 months to apply the patch for a known Apache Struts vulnerability (CVE-2017-5638), and that delay caused 147 million records to leak. Settlements and fines from that one incident eventually reached around $700M. It’s the canonical reminder of how lethal a boring “patch delay” can be.

In 2019, a major US financial services company had a SSRF (Server-Side Request Forgery) caused by a “WAF misconfiguration”, leaking ~100M customer records from S3 buckets. The attacker, a former cloud engineer, exploited a single line of carelessness. The fine was on the order of $80M.

I’ve personally had the experience of noticing a small misconfiguration in logs only six months after the fact. Both the public cases above weren’t sophisticated zero-days — they were the result of “basic operations breaking.” Boring basics are the strongest defense.

Security incidents come from basics neglected, not fancy attacks. Patch, MFA, and config review are the strongest defenses.

Summary

This article covered the big picture of security architecture — the CIA basics, major domains, perimeter-to-Zero-Trust shift, phase-by-phase roadmap, and the AI-era delegation stance.

Delegate to standard protocols and dedicated SaaS, design for defense in depth, start from Zero Trust, keep everything IaC-described and reviewable. The realistic answer for 2026.

The next article covers authentication design (MFA, Passkey, SSO, IDaaS selection).

Back to series TOC -> ‘Architecture Crash Course for the Generative-AI Era’: How to Read This Book

I hope you’ll read the next article as well.