Security Operations · Topic 1 of 10
Security Architecture Concepts
Security architecture for CySA+: defence in depth, segmentation, zero trust, SASE, perimeter devices and the cloud shared responsibility model explained.
- 7 min
- Includes a diagram
- Defence in depth means layered controls, so no single failure exposes everything.
- Segmentation limits lateral movement. Microsegmentation applies the idea per workload.
- A DMZ holds internet facing servers apart from the internal network.
What it is
Security architecture is the way systems, networks and controls are arranged so that an attack has to get past several barriers. A Cybersecurity Analyst (CySA+) needs this because the layout decides what an attacker can reach and what the analyst can see.
The core idea is defence in depth: no single control is trusted to stop everything, so layers back each other up. If one layer fails, the next one still limits the damage and produces evidence.
How it works
Segmentation
Network segmentation splits a network into zones so that a compromise in one zone does not give free access to the rest. Common tools are virtual local area networks (VLANs), subnets with firewall rules between them, and a demilitarised zone (DMZ) for servers that the internet must reach.
Microsegmentation goes further and applies rules per workload or per host, even inside the same subnet. It is common in data centres and clouds because it limits lateral movement, which is an attacker moving from one system to another.
Zero trust
Zero trust is a design approach that gives no automatic trust because of network location. Every request is authenticated and authorised, based on identity, device health and context, and access is limited to what is needed (least privilege).
In the common model, a policy engine makes the decision and an enforcement point applies it. For an analyst, the useful point is that zero trust produces many more identity and access logs to review.
Secure Access Service Edge
Secure Access Service Edge (SASE) delivers networking and security as a cloud service for users who are not in the office. It combines software defined wide area networking (SD WAN) with security functions such as a secure web gateway, a cloud access security broker (CASB) and zero trust network access (ZTNA).
Perimeter and inspection devices
| Device | What it does | Analyst view |
|---|---|---|
| Firewall | Allows or blocks traffic by rule | Logs show allowed and denied connections |
| Intrusion detection system (IDS) | Watches a copy of traffic and alerts | Alerts only, it does not block |
| Intrusion prevention system (IPS) | Sits inline and can block | Alerts plus blocked events |
| Web application firewall (WAF) | Filters web requests at the application layer | Shows attempted web attacks |
| Proxy | Fetches content on behalf of users | Logs of sites visited |
| Network access control (NAC) | Checks a device before it joins | Shows unknown or noncompliant devices |
| Virtual private network (VPN) | Encrypts remote access | Shows who connected from where |
Mobile and endpoint management
Mobile device management (MDM) enrols phones and tablets and enforces policy on them. Unified endpoint management (UEM) extends the idea to laptops and desktops.
- With bring your own device (BYOD) the user owns the device, so work data sits in a separate container that alone is wiped. A corporate owned device can be wiped completely.
- Remote lock and wipe handle a lost or stolen device.
- Compliance checks deny network access to a noncompliant device, such as a rooted one or one without encryption, until it is fixed.
Cloud and virtual environments
In the cloud, the provider and the customer share the work of security. The shared responsibility model means the provider secures the underlying facilities and platform, and the customer secures what they put on it, such as data, identities and configuration.
| Model | Customer usually manages |
|---|---|
| Infrastructure as a service (IaaS) | Operating system, applications, data, access |
| Platform as a service (PaaS) | Applications, data, access |
| Software as a service (SaaS) | Data, access, configuration |
Virtual machines and containers add more layers to watch. A container shares the host kernel, so a weak host affects every container on it.
Cloud native and hybrid designs
Cloud native applications run as many small, replaceable parts.
| Building block | What it is | Visibility effect |
|---|---|---|
| Microservices | Small services calling each other through application programming interfaces (APIs) | Many service to service calls, so gateway logs matter |
| Serverless functions | Code the provider runs on demand | No host for an agent, so provider logs are the evidence |
| Managed services | Databases or queues run by the provider | The customer controls only configuration and access |
| Ephemeral workloads | Containers or instances that live for minutes | Evidence vanishes unless logs leave the workload at once |
The workload may be gone before an analyst looks, so ship logs to a central store at once.
A hybrid cloud combines on premises systems with cloud services, joined by a site to site VPN or a dedicated private link. Monitoring gaps appear at the join: different log formats, traffic on the link that nothing inspects, and separate identity systems.
Operating system basics
Analysts also need a little operating system knowledge to spot oddities. On Windows, important places include the registry (a database of settings, often used for persistence) and system processes with known parent and child relationships. On Linux, configuration files live mostly under /etc, and logs under /var/log.
System hardening means removing unneeded software, services and accounts, and applying secure settings. A hardened baseline also gives the analyst something to compare against.
Critical infrastructure and SCADA
Operational technology (OT) controls physical processes, and industrial control systems (ICS) are the systems that do it. Supervisory control and data acquisition (SCADA) is the supervisory layer for processes spread over distant sites, such as water, power or pipelines.
A control server collects readings from remote terminal units (RTUs) and programmable logic controllers (PLCs) at the sites, and sends commands back. Typical risks are:
- Older protocols such as Modbus and DNP3 with no built in authentication, so any device that can reach them can send commands.
- Equipment that is rarely patched and runs for decades.
- Remote access paths that bridge information technology (IT) and OT.
Defences are segmentation between IT and OT, passive monitoring and tested changes, because availability and safety come first.
What to remember for the exam
- Defence in depth means layered controls, so no single failure exposes everything.
- Segmentation limits lateral movement. Microsegmentation applies the idea per workload.
- A DMZ holds internet facing servers apart from the internal network.
- Zero trust grants access per request using identity, device and context, not network location.
- An IDS detects and alerts. An IPS is inline and can block.
- A WAF protects web applications, while a normal firewall mostly works on addresses and ports.
- SASE moves network and security services to the cloud for remote users.
- In IaaS the customer has the most responsibility, and in SaaS the least.
- A hardened baseline makes deviations easier to spot.
When a question asks which device can actively stop an attack, look for words like inline or prevent. Detection only points to an IDS.
Common mistakes
Treating an IDS as a blocker. An IDS is out of band and only alerts, so it cannot stop a connection by itself.
Thinking the cloud provider secures everything. Customers are still responsible for their own data, identities and settings, and customer side misconfiguration is a common cause of cloud incidents.
Reading zero trust as a product. It is a design approach, not a single device or vendor tool.
Trusting the internal network. A flat network lets an attacker move freely after one foothold, which is why segmentation matters.
Confusing a WAF with a network firewall. A WAF understands web requests, so it can block an injection attempt that a port based rule would allow.
Check yourself
What is the difference between an IDS and an IPS?
An IDS watches traffic and alerts, while an IPS sits inline and can block the traffic.
Why does segmentation help a defender?
It limits lateral movement, so a compromise in one zone does not give access to every other system.
In a SaaS service, who is responsible for the customer data and access settings?
The customer, even though the provider runs the application and platform.
Topic 1 of 10 in Security Operations
Test yourself on Security Operations
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.