Skip to content
Software Architecture Guide

Security

Explanation

Section titled “Explanation”

A secure system resists attacks. It rests on three linked principles, known as the CIA triad: confidentiality, integrity and availability. AWS Well-Architected treats security as one of six pillars. It aims for architectures that protect data, control access and react automatically to security events.

Confidentiality. Data is accessible only to those authorized to see it. A common way to achieve this is need-to-know access, also called least privilege. Each person or component gets only the access it needs.

Integrity. Controls must check who is asking (authentication) and what they may do (authorization). Cryptography helps too. For example, a digital signature shows that data was not changed in transit.

Availability. The system should not go down because of malicious action. A distributed denial-of-service (DDoS) attack is one example. It exhausts the system’s resources and causes downtime.

ISO 25010 adds more terms. The article ISO/IEC 25010 Product Quality Model covers the full model.

  • Accountability: an entity’s actions can be traced uniquely to that entity.
  • Authenticity: a claimed identity can be proved.
  • Resistance: the system keeps operating while a malicious actor attacks it.

Detection and recovery. Audit logs speed up detection and recovery after incidents. They also support ongoing security monitoring. Threat modeling is recommended to identify and reduce threats.

Example

Section titled “Example”

A web shop stores customer orders. Only the order service and support staff may read them (confidentiality, need-to-know). Payment messages carry a digital signature, so tampering can be detected (integrity). The shop is designed so a flood of fake requests cannot take it offline (availability). Audit logs record who changed which order (accountability).

Trade-offs

Section titled “Trade-offs”

Security and reliability can pull in opposite directions. Security design can add points of failure and operational complexity, so the team must weigh this trade-off.

Security controls should block attackers but not legitimate users. Every control that blocks access risks hurting availability, so the two need balancing. See the articles Availability and Quality Attribute Trade-off.

Checks

Section titled “Checks”
  • Confidentiality requirements state who may access which data, using need-to-know (least privilege) access.
  • Integrity measures cover authentication, authorization and tamper detection such as digital signatures.
  • The design addresses attacks, such as DDoS, that could exhaust resources and cause downtime.
  • Audit logging and threat modeling are described as ways to detect threats and recover.
  • Trade-offs between security and reliability or availability are stated and weighed.
Section titled “Related”

Sources

Section titled “Sources”