Cybersecurity Specialization: Architecture and Policy

Frameworks and the Lifecycles

• IT lifecycle management
• Frameworks
• Stakeholders
• Security policies

Design a Network Security Architecture

• Network segmentation
• Network components
• Practice: Identify network flows
• Industry best practices
• Roles and responsibilities

Design a Secure Application Architecture

• History of development
• The application architect
• Application architecture goals
• Service-oriented architecture (SOA)
• Modular framework development
• Authentication
• Patching
• Vulnerability testing

Design a Data Security Architecture

• Data architecture
• Classification of data
• Privacy
• Database security
• Encryption
• Big data
• Data architecture analysis
• Data architecture influences

Design an Access Control Security Architecture

• Identity and access management
• Access control policy
• Access control models
• Centralized access control
• Bring your own device
• Access reviews

Update a Security Architecture

• Impact of change
• Life cycle management
• Architecture changes

Document a Security Architecture

• Documentation life cycle
• Input documentation
• Architecture documentation
• Output documentation
• Security requirements traceability matrix (RTM)

Examine Alternative Architectures

• Virtualization
• Cloud security architecture
• Shared responsibility
• Encryption
• Key management for cloud

Course Look Around

• Look back at what you learned
• Look ahead
• Consider additional training

• Security architect’s role in the security lifecycle
• Use recognized frameworks to support controls and reduce risk
• Capture security requirements for network, application, data, and access control architectures
• Design appropriate access controls based on the mission of the organization including role based, task based, or other access controls
• Verify compliance to standards for an architecture
• Update an architecture to mitigate risk in response to a security auditor’s list of findings
• Establish security policy creation and management
• Design secure virtualized environments
• Identify components and concerns that might impact a cloud migration
• Examine options for incorporating key management into your architecture
• Document an architecture in an appropriate format representing requirements and domains

• Challenge: Design a network security architecture
• Challenge: Design a secure application architecture
• Challenge: Design a data security architecture
• Challenge: Design an access control security architecture
• Challenge: Update a security architecture
• Challenge: Document a security architecture
• Challenge: Examine alternative architectures

Any mid-career or intermediate level person with an interest in security architecture and who has been in a cybersecurity role or organization for at least 2 years.

While security architect is typically a senior role in many organizations, Cybersecurity Specialization: Architecture and Policy is a mid-level course focused on building the skills a security architect will use on the job.

As such, the ideal candidate for this course will already have strong technical skills and experience in more than one technical area (for example, network infrastructure configuration, web services, and identity and access management), but may have more limited experience in cybersecurity.

They may have an interest in security architecture but no experience, or they may be performing some architecture tasks already as part of their job.