Catalog
concept#Security#Governance#Architecture#Reliability

Cyber Security

Cyber security denotes measures, principles and strategies to protect digital systems, data and networks from attacks, misuse and failures.

Cyber security comprises a broad spectrum of technical, organisational and procedural measures for confidentiality, integrity and availability of information.
Established
High

Classification

  • High
  • Organizational
  • Architectural
  • Advanced

Technical context

SIEM and log aggregation platformsIdentity providers and IAM systemsCI/CD pipelines and DevOps toolchain

Principles & goals

Defense-in-depth: layered protection reduces single points of failure.Least privilege: grant minimal necessary rights.Continuous monitoring and improvement.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Lack of governance leads to inconsistent security measures.
  • Outdated systems increase attack surface.
  • Human error and social engineering remain critical risks.
  • Integrate automated security checks into CI/CD.
  • Conduct regular security and penetration tests.
  • Apply least privilege and role-based access control.

I/O & resources

  • Asset inventory and data classification
  • Risk assessment and threat model
  • Security policies and role models
  • Protective controls and configuration standards
  • Monitoring and alerting mechanisms
  • Incident reports and remediation actions

Description

Cyber security comprises a broad spectrum of technical, organisational and procedural measures for confidentiality, integrity and availability of information. It combines risk assessment, protective controls and detection mechanisms and requires cross-functional coordination plus continuous adaptation to evolving threats.

✔

  • Reduced likelihood of successful attacks.
  • Protection of critical business processes and reputation.
  • Improved compliance and auditability towards regulators.

✖

  • No absolute security; residual risks remain.
  • High resource and expertise requirements.
  • Potential conflicts between security and usability.

  • Mean time to detect (MTTD)

    Average time from the occurrence of a security breach to detection.

  • Mean time to restore (MTTR)

    Average time to restore normal services after an incident.

  • Number of critical vulnerabilities

    Number of unresolved high-criticality vulnerabilities within a reporting period.

NIST Cybersecurity Framework implementation

Organization uses NIST CSF to structure risks, controls and maturity measurement.

Zero-trust network architecture in the enterprise

A global company applies zero-trust principles for segmentation and identity verification.

OWASP Top Ten used as developer checklist

Development teams integrate OWASP checks into CI/CD to avoid web vulnerabilities.

1

Perform inventory and risk assessment.

2

Define governance and responsibility structure.

3

Prioritize controls and implement them iteratively.

⚠️ Technical debt & bottlenecks

  • Old libraries without signed security updates.
  • Incompatible logging formats hinder forensics.
  • Missing automation for patch and configuration management.
Legacy systems without patching processResource constraints in security teamInsufficient telemetry for forensics
  • Focusing only on firewall rules without patch management.
  • Skipping backup strategies for cost reasons.
  • Excessive restrictions that block business processes.
  • Underestimating insider threats and employee risks.
  • Neglecting maintenance of security rules and exceptions.
  • Undefined backup and recovery tests.
Network and system architecture understandingExperience with threat modelling and forensicsKnowledge of compliance and privacy requirements
Confidentiality, integrity and availability of dataRegulatory requirements and complianceScalability and operational resilience
  • • Budget constraints for security investments
  • • Legal requirements for data sharing and privacy
  • • Technical dependencies on third parties