Catalog
concept#Security#Architecture#Governance#Software Engineering

Security

Security comprises principles and measures to protect information, systems and processes from threats and misuse.

Security describes measures, principles and processes to protect information, systems and infrastructure from threats and misuse.
Established
High

Classification

  • High
  • Organizational
  • Architectural
  • Advanced

Technical context

SIEM systems (Security Information and Event Management)IAM and single sign-on solutionsCI/CD toolchain for security checks

Principles & goals

Prioritize confidentiality, integrity and availabilityRisk-based approach instead of checkbox complianceDefense-in-depth: multiple independent layers of defense
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Excessive complexity from too many controls
  • Incorrect trust assumptions in third-party systems
  • Insufficient response to emerging threats
  • Enforce least-privilege principle
  • Regular patch and vulnerability management
  • Continuous monitoring and tabletop exercises

I/O & resources

  • Asset inventory and classification
  • Threat and risk analysis
  • Legal and regulatory requirements
  • Risk-based security controls and policies
  • Monitoring and incident response processes
  • Audit trails and compliance evidence

Description

Security describes measures, principles and processes to protect information, systems and infrastructure from threats and misuse. It includes organizational policies, technical controls and continuous monitoring. The goal is to ensure confidentiality, integrity and availability across the full lifecycle while balancing risk and usability.

✔

  • Reduced downtime and reputational risk
  • Fulfillment of regulatory requirements
  • Increased customer and partner trust

✖

  • Requires organizational effort and continuous maintenance
  • Not all risks can be completely eliminated
  • Potential conflicts with usability and speed

  • Mean time to detect (MTTD)

    Average time between occurrence of a security event and its detection.

  • Mean time to remediate (MTTR)

    Average time from discovery of a vulnerability to complete remediation.

  • Number of confirmed security incidents

    Number of incidents within a defined time period.

ISO/IEC 27001 implementation

Example of an organization implementing an ISMS based on ISO 27001, including risk management and policies.

OWASP Top Ten assessment

Code review and testing against OWASP Top Ten vulnerabilities to reduce web risk.

Zero-trust design in a cloud environment

Architecture example for fine-grained access control, network segmentation and continuous monitoring.

1

Inventory and classify critical assets

2

Select controls and policies based on risk

3

Automate checks and continuous monitoring

⚠️ Technical debt & bottlenecks

  • Old systems without modern authentication mechanisms
  • Incomplete inventory leading to blind spots
  • Manual security processes without automation
Lack of specialized personnelLegacy infrastructure lacking modern controlsInsufficient monitoring and telemetry coverage
  • Only ticking compliance checklists without risk focus
  • Blocking all access and impacting productivity
  • Lack of review for third-party components
  • Over-reliance on legacy security solutions
  • Unrealistic assumptions about risk likelihood
  • Lack of clarity in responsibilities
Threat modeling and risk managementNetwork and system architecture knowledgeKnowledge of compliance and data protection
Compliance and regulatory requirementsProtection of critical business processesResilience against threats
  • • Budget and resource constraints
  • • Legal and data protection requirements
  • • Technical dependencies on third-party providers