Enterprise Security Architecture

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Enterprise Security Architecture (ESA).
Learn how organisations design secure cloud environments.
Understand the principles of Defence in Depth and Zero Trust.
Identify the different layers of enterprise security.
Learn where Cloud Security Engineers fit within an enterprise architecture.
Understand how AWS security services work together to protect cloud workloads.

📚 Lesson Information

Estimated Time: 2.5 Hours

Difficulty: Beginner

Prerequisites: Enterprise Cloud Architecture

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Large organisations don’t rely on a single security product.

Instead, they build multiple security layers so that if one control fails, another continues protecting the business.

Enterprise Security Architecture is the blueprint that ensures people, processes, technology and cloud services work together to protect business assets.

A Cloud Security Engineer spends much of their time designing, implementing and improving this architecture.

🌍 What is Enterprise Security Architecture?

Enterprise Security Architecture (ESA) is the structured design of security controls that protect an organisation’s:

People
Applications
Data
Networks
Cloud Infrastructure
Devices
Identities
Business Processes

It provides a consistent security framework across the entire organisation.

Think of it as the security blueprint for the company.

🏢 CloudNova Technologies

CloudNova Technologies operates:

Customer Portal
Internal HR Application
Finance Systems
Kubernetes Platform
AWS Production Environment
AWS Development Environment
Remote Workforce
Third-party SaaS Applications

Every system must work together securely.

Instead of securing each application independently, CloudNova creates one Enterprise Security Architecture that defines how security should be implemented across the business.

🏗️ Enterprise Security Layers

Security exists at multiple layers.

Users
│
▼
Identity Security
│
▼
Endpoint Security
│
▼
Network Security
│
▼
Application Security
│
▼
Platform Security
│
▼
Data Security
│
▼
Monitoring & Detection
│
▼
Incident Response
│
▼
Business Continuity

If one layer fails, another layer continues protecting the organisation.

🛡️ Defence in Depth

Defence in Depth means using multiple security controls instead of relying on a single control.

Example:

A production web application might use:

MFA
IAM Policies
Security Groups
Network ACLs
AWS WAF
AWS Shield
Encryption
CloudTrail
GuardDuty
Security Hub

Even if one control is bypassed, others continue protecting the environment.

🚫 Zero Trust Architecture

Traditional security assumed that anything inside the corporate network was trusted.

Zero Trust follows a different principle:

Never Trust. Always Verify.

Every request must be:

Authenticated
Authorised
Logged
Continuously evaluated

Examples:

MFA required for administrators.
Device health verification.
Least Privilege IAM.
Conditional access policies.
Continuous monitoring.

Zero Trust reduces the impact of compromised credentials.

🔑 Identity Security

Identity is the first security layer.

Controls include:

IAM
IAM Roles
IAM Policies
MFA
Identity Center (SSO)
Federation
Password Policies
Access Reviews

Identity determines who can access enterprise resources.

🌐 Network Security

Network security protects communication between systems.

Typical controls include:

VPC
Subnets
Security Groups
Network ACLs
AWS Network Firewall
VPN
Transit Gateway
PrivateLink
Route Tables

The objective is to minimise unnecessary network exposure.

💻 Compute Security

Enterprise workloads run on:

EC2
Containers
Kubernetes
Lambda

Security controls include:

Patch Management
Hardened Images
Endpoint Protection
Secure AMIs
Vulnerability Scanning
Runtime Monitoring

📦 Data Security

Data is the organisation’s most valuable asset.

Controls include:

Encryption
AWS KMS
S3 Bucket Policies
Backup
Versioning
Data Classification
Access Logging

Security Engineers focus on protecting data throughout its lifecycle.

📱 Application Security

Applications should be secure by design.

Controls include:

Secure Development Lifecycle (SDLC)
Static Code Analysis (SAST)
Dynamic Testing (DAST)
Dependency Scanning
Secrets Management
API Security
Input Validation

Security begins during software development.

📊 Monitoring & Detection

Security architecture includes continuous monitoring.

AWS services include:

CloudTrail
CloudWatch
GuardDuty
Inspector
Security Hub
AWS Config
Detective

These services provide visibility into cloud activity and help detect threats.

🚨 Incident Response

Every architecture must include an incident response capability.

Preparation includes:

Incident Response Plan
Playbooks
Logging
Backup
Recovery Procedures
Communication Plan

The goal is to minimise business disruption.

♻️ Business Continuity & Disaster Recovery

Security architecture must ensure business resilience.

Key concepts:

High Availability
Fault Tolerance
Backup
Disaster Recovery
Multi-AZ Deployments
Multi-Region Architecture

Business continuity is as important as preventing attacks.

☁️ Enterprise Security Architecture on AWS

A simplified AWS enterprise security architecture:

                 Internet
                     │
          AWS Shield + AWS WAF
                     │
          Application Load Balancer
                     │
        ┌────────────┴────────────┐
        │                         │
     Public Subnet           Public Subnet
        │                         │
        └────────────┬────────────┘
                     │
              Private Subnets
        ┌────────────┴────────────┐
        │                         │
      EC2 / EKS              Lambda
        │                         │
        └────────────┬────────────┘
                     │
              Database Tier
             (Amazon RDS)
                     │
               AWS KMS Encryption
                     │
              Backup & Monitoring
                     │
CloudTrail • GuardDuty • Config • Security Hub

Every layer has dedicated security controls.

👨‍💼 Role of a Cloud Security Engineer

A Cloud Security Engineer is responsible for:

Designing secure cloud architectures.
Reviewing IAM permissions.
Implementing encryption.
Managing Security Groups.
Monitoring security events.
Supporting incident response.
Conducting security reviews.
Performing compliance checks.
Advising development teams.
Improving security posture continuously.

Security Engineers work across every layer of the architecture.

🏢 Enterprise Scenario

CloudNova Technologies

CloudNova plans to launch a new customer-facing application.

The proposed architecture includes:

Public EC2 instance hosting both the web application and database.
Shared administrator account.
No MFA.
Public S3 bucket storing customer invoices.
No logging enabled.
No backups.
No monitoring.
No Web Application Firewall.
Database accessible from the internet.

As the Cloud Security Engineer:

Identify every security weakness.
Recommend architectural improvements.
Which AWS services would you implement?
How would Defence in Depth improve the design?
How would Zero Trust principles change this architecture?

🧪 Hands-on Exercise 1 — Explore AWS Security Services

Navigate to:

AWS Console

Locate:

IAM
VPC
Security Groups
CloudTrail
GuardDuty
Security Hub
AWS Config
AWS WAF
AWS Shield
AWS Backup

Questions:

What role does each service play in the enterprise architecture?
Which layer does each service protect?

🧪 Hands-on Exercise 2 — Layer Mapping

Complete the table below.

Security Layer	AWS Service
Identity	IAM
Network
Compute
Data
Monitoring
Backup
Threat Detection

Discuss your answers with your mentor or classmates.

🧪 Hands-on Exercise 3 — Defence in Depth Review

For the following scenario, identify at least three security controls.

Scenario	Controls
Public web application
Amazon RDS database
IAM Administrator
Customer data in S3

Questions:

Which control prevents attacks?
Which control detects attacks?
Which control supports recovery?

🧪 Hands-on Exercise 4 — Zero Trust Assessment

Review the following requirements.

Developer working remotely.
Accessing production AWS account.
Using personal laptop.
Wants AdministratorAccess.

Answer:

Should access be granted?
What additional controls are required?
How would you verify the user and device?
How would you apply Least Privilege?

🧪 Hands-on Exercise 5 — Build Your Enterprise Security Architecture

Design a high-level architecture for CloudNova Technologies.

Include:

Users
IAM
VPC
Public Subnets
Private Subnets
Load Balancer
EC2
RDS
S3
KMS
CloudTrail
GuardDuty
Security Hub
AWS Backup
WAF
Shield

Draw the architecture using:

draw.io
Lucidchart
Excalidraw
Microsoft Visio

Label each security control and explain its purpose.

📊 Knowledge Check

Answer the following questions:

What is Enterprise Security Architecture?
Why is Defence in Depth important?
What is Zero Trust?
Why is identity considered the new security perimeter?
Which AWS services secure the network layer?
Which AWS services help detect threats?
What is the purpose of AWS Security Hub?
Why is monitoring essential?
How does Business Continuity support security?
What are the key responsibilities of a Cloud Security Engineer?

📝 Assignment

Prepare an Enterprise Security Architecture Review for CloudNova Technologies.

Include:

Enterprise Security Architecture overview.
Defence in Depth strategy.
Zero Trust implementation.
Layer-by-layer security controls.
AWS security services used.
Security architecture diagram.
Recommendations for improving CloudNova’s security posture.

Length: 4–5 pages, including at least one architecture diagram.

💡 Key Takeaways

After completing this lesson, you should understand:

Enterprise Security Architecture provides a structured approach to securing the organisation.
Security is implemented through multiple layers rather than a single control.
Defence in Depth ensures resilience if one control fails.
Zero Trust requires every request to be authenticated, authorised, and monitored.
AWS offers integrated services for identity, network, compute, data, monitoring, and incident response.
Cloud Security Engineers are responsible for designing, implementing, and continuously improving enterprise security architectures.

📚 Further Reading

AWS Well-Architected Framework – Security Pillar
AWS Security Reference Architecture (AWS SRA)
AWS Prescriptive Guidance – Security
NIST Cybersecurity Framework (CSF) 2.0
NIST SP 800-207 – Zero Trust Architecture
CIS Controls v8
ISO/IEC 27001 & ISO/IEC 27002

🚀 Next Lesson

➡️ Day in the Life of a Cloud Security Engineer