SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

Overview

This first section describes the principles of designing and building defensible systems and networks. Students begin with the fundamentals of security architecture and the journey toward Zero Trust, including a vendor-neutral and realistic view of Zero Trust based on US and international guidance, maturity models, and design principles. The section compares traditional security architecture with defensible security architecture and introduces the DARIOM lifecycle: Discover, Assess, Re-Design, Implement, Operate, and Monitor.

The main emphasis is practical threat modeling and architecture decision-making. Students use MITRE ATT&CK, ATT&CK Navigator, DeTT&CT, and MITRE ATLAS awareness to prioritize countermeasures, identify attack paths, and understand how AI-assisted reconnaissance and machine-speed adversary workflows change defensive design. The section also introduces Time-Based Security and shows how prevention, detection, response, and resilience are shaped by architecture choices.

The section then builds from the bottom up, starting with physical security, wireless security, Layer 2 controls, VLANs, PVLANs, flow data, and egress analysis. Students learn how to baseline normal network activity with NetFlow, IPFIX, sFlow, VPC Flow Logs, Suricata flows, endpoint flow data, and cloud flow telemetry, then normalize and reason about those signals using OCSF-aware design patterns that support AI-era visibility and decision support.

Full Lab Details

• Practical Threat Modeling with MITRE ATT&CK: Students learn practical threat modeling with MITRE ATT&CK and apply it as an architecture prioritization model throughout the course. The lab helps all-around defenders become threat-focused instead of vulnerability-focused, identifying the most important risks and designing controls that disrupt realistic adversary behavior.
• Egress Analysis: Students examine common exfiltration paths, including DNS tunneling and other outbound channels, then layer defenses to increase protection time while increasing the chance that engineered telemetry will expose unauthorized movement.
• Layer 2 Attacks: Students identify relevant Layer 2 attacks that still affect modern organizations, including ARP spoofing, DHCP attacks, VLAN misuse, and client-to-client pivoting risks that can be reduced through secure architecture.
• Architecting for Flow Data: Students compare flow data sources and learn where to position and how to use NetFlow, IPFIX, sFlow, cloud flows, Suricata flows, and endpoint telemetry to identify unauthorized or anomalous activity across hybrid environments.

Full Topic Details

• Security architecture, security architects, and the Tyrell Corporation case study
• Defensible security architecture, presumption of compromise, de-perimeterization, and Think Red, Act Blue
• Risk-driven and business outcome-focused architecture, cyber resiliency, ruthless prioritization, and disrupting attacker ROI
• Practical threat modeling, purple teaming, MITRE ATT&CK, MITRE ATLAS awareness, Cyber Kill Chain, Time-Based Security, and AI-assisted attack-path analysis
• Zero Trust strategy, NIST SP 800-207, CISA ZTMM, UK NCSC guidance, NSA ZIG pillars, and realistic Zero Trust design principles
• DARIOM: discovery, assessment, redesign, implementation, operation, monitoring, threat vector analysis, ingress mapping, egress mapping, data flow analysis, and attack surface analysis
• Layer 1 and Layer 2 architecture, physical security, penetration testing dropboxes, USB keyboard attacks, wireless, Zigbee, RFID badges, WPA3 Enterprise, station isolation, and private 5G architecture
• VLANs, PVLANs, switch hardening, ARP spoofing defenses, DHCP attack mitigation, NetFlow, IPFIX, sFlow, JFlow, VPC Flow Logs, Suricata flows, endpoint flow, cloud flows, OCSF normalization, and flow design

Overview

This section continues the discussion of hardening critical infrastructure in hybrid environments. Routers, switches, firewalls, SD-WAN devices, cloud routing controls, and segmentation points remain high-value targets for adversaries because they shape trust boundaries, traffic paths, visibility, and enforcement. Students learn how to harden edge infrastructure, validate configuration baselines, and engineer network devices as Zero Trust enforcement points.

The section provides actionable examples for router and switch hardening, including secure administration, AAA, TACACS+, RADIUS, logging, configuration review, SNMPv3, NTP/NTS, bogon filtering, blackholes, darknets, and secure routing practices. It also covers IPv6 in depth, emphasizing common mistakes such as applying an IPv4 mindset to IPv6, missing rogue router advertisement risks, and overlooking unauthorized transition tunnels.

The section then moves into segmentation, one of the most important Zero Trust architecture topics. Students compare macro-segmentation, micro-segmentation, network segmentation, access segmentation, OT/ICS segmentation, data diodes, and identity-based segmentation. They connect traditional network engineering to current industry concepts such as SD-WAN, SSE, ZTNA, SASE, NAC, OpenZiti, Software-Defined Perimeter (SDP), and AI-era lateral movement reduction.

Full Lab Details

• Router Security: Students identify and mitigate security issues in routers by reviewing configuration weaknesses, management-plane exposure, logging gaps, and hardening opportunities. In a live cloud-based router lab, students perform attacks against SNMP, understand the risk of weak community strings and configuration exposure, and remove the threat through secure SNMP design.
• IPv6: Students interact with IPv4 and IPv6 to understand differences in addressing, discovery, tunneling, extension headers, router advertisements, and firewall/security control assumptions.
• Identity-Based Segmentation with OpenZiti: Students compare traditional Layer 3/4 segmentation with identity-based policies, then enforce departmental segmentation using ZTNA concepts emulated with OpenZiti.

Full Topic Details

• Layer 3 attacks and mitigation, IP source routing, ICMP attacks, unauthorized routing updates, unauthorized tunneling, and securing routing protocols
• Switch, router, firewall, and SD-WAN best practices, Cisco IOS hardening examples, CIS Benchmarks, DISA STIGs, Nipper-ng, Cisco AutoSecure, and configuration validation
• AAA, TACACS+, RADIUS, secure administration, logging, banners, management-plane exposure, and secure services
• SNMP community string guessing, Cisco IOS configuration download through SNMP, SNMPv3, NTP authentication, NTP amplification, and NTS
• Bogon filtering, fullbogons, blackholes, darknets, darknet traffic monitoring, and IP blackhole packet vacuums
• IPv6 addressing, address assignment, extension headers, firewall support, scanning, discovery, tunneling, rogue router advertisements, Neighbor Discovery attacks, and protocol 41 visibility
• Segmentation principles, firewall architecture, DMZ design, beyond-DMZ zone design, OT reference architecture, data diodes, network vs. access segmentation, and security-operations-aware architecture
• Traditional segmentation, identity-based segmentation, NAC, 802.1X, OpenZiti architecture and components, SDP, ZTNA, SASE, SSE, microsegmentation, and AI-era lateral movement reduction

Overview

Organizations own or have access to many network-based security technologies, including NGFWs, IDS/IPS, NDR, NSM sensors, proxies, VPNs, ZTNA, SASE, SSE, cloud firewalls, and email security gateways. These controls are often deployed on-premises and in the cloud, but their effectiveness depends heavily on architecture, placement, configuration, and integration. This section focuses on engineering network-centric visibility and secure access with a Zero Trust mindset.

Students examine how over-reliance on built-in automatic capabilities such as application control, antivirus, intrusion prevention, data loss prevention, and deep packet inspection can leave significant gaps. This section of SEC530 teach students how architecture choices improve prevention, engineered visibility, detection support, and response options. This includes understanding SPAN versus TAP design, sensor placement, cloud telemetry, Zeek, Suricata, JA3/JA4/JA4S, Security Onion, and SIEM integration.

The section also covers secure access and encryption tradeoffs. Students compare VPNs, ZTNA, SASE, SSE, OpenZiti, remote browser isolation, Apache Guacamole, proxies, SWG, email controls, mTLS, PKI, IPsec, ZTDNS, TLS inspection, QUIC/HTTP/3, Encrypted Client Hello, certificate transparency, and post-quantum cryptography readiness. The section emphasizes how to preserve useful visibility as traffic becomes encrypted and as AI-enabled data theft blends into normal-looking web, API, SaaS, GenAI, and agentic AI workflows.

Full Lab Details

• Architecting for NSM: Students learn how to place and implement NSM technologies for visibility and application/protocol awareness, then use Zeek and correlation techniques to reason about tunnels, C2, beaconing, and AI-era exfiltration paths.
• Network Security Monitoring: Students use intrusion detection alerts and network metadata to understand unauthorized network activity. The lab emphasizes what telemetry the architecture must produce so tools such as Suricata and Security Onion can support analysis and validation.
• Encryption Considerations: Students explore how TLS and encryption protect data from attackers and defenders alike, then evaluate how proxies, NGFWs, NSM, TLS inspection, mTLS, PKI, and certificate transparency affect architecture choices.

Full Topic Details

• NGFW architecture, application filtering, implementation strategies, external dynamic lists, DNS security, DNS filtering, sinkholing, infrastructure as code, Terraform, cloud NGFWs, scripting, and APIs
• NDR and NSM architecture, alert-driven versus data-driven workflows, architecting for network visibility, network metadata, know-thy-network principles, SPAN ports, TAPs, sensor placement, and cloud telemetry
• Zeek with a Zero Trust mindset, JA3, JA4, JA4S, RITA, beaconing with machine learning, Kubernetes visibility with Zeek, Security Onion, Suricata, Snort, IDS/IPS rule writing, SIEM integration, and protocol analysis
• Web proxies, explicit versus transparent proxy design, delegated DNS, ICAP, forward and reverse proxies, Secure Web Gateway, remote browser isolation, malware detonation sandboxes, and proxy-based data control
• SMTP proxies, phishing protection, Bayesian analysis, SPF, DKIM, DMARC, ARC, BIMI, typosquatting detection, dnstwist, and combating open-source intelligence abuse
• Secure remote access, TLS VPN, SSH VPNs, Always On VPN, WAN optimization, rethinking VPN strategies, ZTNA, SASE, SSE, OpenZiti overlay networks, HTML5 remote desktop with Guacamole, and hybrid architecture access paths
• Encryption architecture, encrypt-everything mindset, HSTS preloading, certificate transparency monitoring, crypto suite support, PFS, TLS 1.2 versus TLS 1.3, TLS interception tradeoffs, QUIC/HTTP/3, Encrypted Client Hello, mTLS, ZTDNS, and PQC readiness

Overview

The journey continues with data-centric security, a strategy central to Zero Trust architecture and AI-era security. Organizations cannot protect what they do not know exists, yet sensitive data often lives behind reverse proxies, web applications, APIs, application servers, database servers, microservices, cloud services, SaaS platforms, hypervisors, private clouds, containers, and developer pipelines. This section focuses on identifying, classifying, governing, and protecting important data wherever it resides.

Students learn how to prioritize security controls around critical data rather than trying to protect everything equally. The section covers WAAP, WAFs, API gateways, OWASP Top 10, OWASP API Security Top 10, RASP, database security, database activity monitoring, data discovery, data masking, encryption at rest, encryption in use, confidential computing, post-quantum-aware encryption, HSM/KMS design, Microsoft Purview, DSPM, CASB, DLP, insider risk management, AI data provenance, shadow AI governance, and GenAI exfiltration controls.

The section also covers privileged access, identity defense, and workload security. Students learn how to apply the Clean Source Principle, Microsoft’s Tiered Administration Model, Privileged Access Workstations (PAWs), Just-in-Time access, PIM/PAM, context-aware access, workload identities, BYOD, MDM, Intune, private cloud hardening, hypervisor security, Docker, Kubernetes, SBOMs, secrets management, image supply chain protection, and CNAPP/CSPM/CWPP/CIEM concepts.

Full Lab Details

• Securing Web Applications: Students identify the prevention, visibility, and validation capabilities of web application firewalls, then examine where WAFs can be evaded and how to apply changes that block and detect evasion techniques.
• Discovering Sensitive Data: Students walk step-by-step through writing a PowerShell script to crawl a file system for sensitive data. The lab reinforces why data discovery, classification, DSPM, DLP, and AI data governance depend on knowing where sensitive information resides.
• Secure Virtualization: Students examine the implications of attackers gaining host access to a hypervisor or container system and apply hardening and response-oriented architecture steps for virtualization and container platforms.

Full Topic Details

• Data-centric security, reverse proxies, full-stack security, monolithic applications, web servers, app servers, database servers, microservices, APIs, and cloud-native application architecture
• Web application firewalls, OWASP Top 10, OWASP API Security Top 10, DDoS scrubbing, reverse proxy plus PAM, TLS offloading, ModSecurity, WAF bypass, normalization, dynamic content routing, WebLabyrinth, WAAP, open-appsec, RASP, and Zero Trust for cloud-native applications
• API gateways, API security, NIST SP 800-207A, OpenZiti SDKs, workload identity, service-to-service access, and AI-enabled application risk
• Database firewalls, database activity monitoring, data masking, advanced access controls, authenticated scanning, Snowflake-style credential abuse, database logging architecture, and exfiltration monitoring
• Data encryption at rest, encryption in use, confidential computing, HSM/KMS design, post-quantum-aware encryption, BitLocker, TPM, network unlock, breach disclosure reduction, and crypto architecture decisions
• File classification, data discovery, scripts versus software solutions, OCR scanning, Microsoft Purview Information Protection, sensitivity labels, DSPM, CASB, DLP, insider risk management, AI data provenance, shadow AI governance, and GenAI exfiltration controls
• Entra ID and RBAC, time restrictions, MDM, MAM, BYOD, Intune MAM versus MDM, Conditional Access with Intune, and mobile/application enforcement patterns
• Privileged access and identity defense, BloodHound, PingCastle, Clean Source Principle, Tiered Administration Model, PAWs, JIT, PIM/PAM, jump boxes, bastion hosts, private cloud security, vSphere, Xen, Hyper-V, VMware NSX, VM escape, hypervisor-based endpoint protection, Docker, Kubernetes security, SBOM, secrets, CNAPP, CSPM, CWPP, CIEM, image supply chain, and runtime visibility

Overview

Trust but verify is no longer enough. Section 5 shifts the architecture toward dynamic trust, applying context, identity, device state, telemetry, risk, and continuous assurance before granting access. Students bring together the architecture built throughout the course, from network segmentation and microsegmentation to control-plane and data-plane separation, to implement variable-trust architectures that adapt dynamically to risk.

The section revisits Zero Trust through NSA ZIG, NIST guidance, federal strategy, and practical implementation patterns. It then focuses on identity as a perimeter, including Entra ID, IAM, IdP federation, RBAC, SSO, SAML, OAuth 2.0, OIDC, MFA, FIDO2, passkeys, passwordless authentication, credential rotation, NIST 800-63B, service accounts, managed service accounts, token theft, PRT abuse, OAuth consent phishing, AiTM phishing, MFA fatigue, cross-tenant movement, and Conditional Access.

Students then design ITDR architecture and AI-augmented enforcement. The section covers identity telemetry, UEBA, behavioral baselining, OCSF normalization, agentic AI security, non-human identities, OWASP Agentic AI risks, OWASP Top 10 for LLM Applications, MITRE ATLAS, LangGraph orchestration, risk scoring, human-in-the-loop gates, SOAR integration patterns, Conditional Access enforcement, Sigma, Sysmon, auditd, MITRE mappings, deception, red herrings, honeytokens, identity deception, canary tokens, and AI-resilient defense.

Full Lab Details

• ITDR Part 1: Identity Attacks in the Cloud: Students investigate modern cloud identity attacks, including token theft, OAuth abuse, consent phishing, PRT abuse, cross-tenant movement, and Conditional Access gaps, then reason about the telemetry and control architecture required to reduce identity risk.
• ITDR Part 2: Agentic AI Orchestration, Risk Scoring, and Conditional Access Response: Students use OCSF-style signals, risk scoring, and agentic AI orchestration patterns to connect identity findings to enforcement decisions while preserving human-in-the-loop accountability.
• Sigma Generic Signatures: Students use Sigma rules and conversion workflows to express portable detection logic, map coverage to MITRE ATT&CK, and validate that the architecture produces useful signals across SIEM and analytics platforms.
• Advanced Defense Strategies: Students configure deception and adversary-disruption techniques that allow internal systems to keep functioning while attack tools fail or reveal themselves, including honeytokens, identity deception, red-herring defenses, and cloned-site detection concepts.

Full Topic Details

• Zero Trust architecture, variable trust, control-plane and data-plane separation, NIST SP 1800-35, federal Zero Trust strategy, NSA ZIG activity levels, Conditional Access, SASE, microsegmentation, and realistic Zero Trust auditing
• Identity as a perimeter, IAM, Entra ID, RBAC, identity federation, SaaS applications, federated SSO, SAML, OAuth, OIDC, modern versus legacy authentication, MFA, FIDO2, passkeys, passwordless, and credential rotation
• Adversary-in-the-Middle phishing, MFA fatigue, MFA bypass, OAuth consent phishing, MSGraph risk, token theft, PRT abuse, CAE, cross-tenant movement, Silk Typhoon-style identity attacks, ITDR architecture, UEBA, identity telemetry, behavioral baselining, and enforcement thresholds
• Securing traffic with mTLS, mutual TLS for API security, ZTDNS plus mTLS, single-packet authorization, 802.1X, client certificates, PKI, endpoint firewalls, Microsoft Attack Surface Reduction, application control, and endpoint privilege reduction
• Dynamic authorization, adaptive trust, device compliance, Microsoft Intune and NAC, quarantine, automated digital response, and Conditional Access enforcement
• AI in Zero Trust, AI versus ML, GenAI for cybersecurity, human-machine teaming, agentic AI security, non-human identities, OWASP Agentic AI risks, OWASP Top 10 for LLM Applications, MITRE ATLAS, LangGraph, OCSF, risk scoring, SOAR integration, and human-in-the-loop gates
• Log collection architecture, SIEM in the cloud era, logs that matter, Windows auditing, Linux auditing, Sysmon, auditd, hybrid and cross-cloud logging strategy, designing for analysis rather than log collection, and MITRE ATT&CK content engineering
• Sigma, Sigma conversion, Sigma2Attack, anomaly identification versus real-time alerts, MITRE Engage, deception architecture, tripwires, red herrings, honeynets, honeypots, honeytokens, identity deception, canary tokens, HALO, and proactive defenses that change attacker tool behavior

Overview

The course concludes with an immersive team-based Secure the Flag challenge powered by SANS Cyber Ranges. Students apply the principles built throughout SEC530 in a full-day hands-on architecture challenge. Teams assess, design, harden, validate, and defend Tyrell Corporation systems using network, application, data, identity, telemetry, encryption, segmentation, and enforcement concepts from the entire course.

The capstone emphasizes architecture and engineering under pressure. Students must identify weaknesses in a provided environment, understand what changed, decide which controls matter most, and apply practical changes that improve resilience. The challenge reinforces Zero Trust thinking, AI-era visibility, data protection, identity defense, ITDR, secure access, deception, and defensible design.

Full Lab Details

• Capstone - Design, Detect, Defend: Students work through a realistic Secure the Flag environment in which they must assess the initial state, identify weaknesses, prioritize architecture improvements, apply defensive changes, validate their impact, and defend Tyrell Corporation systems from a replicant attack scenario.

Full Topic Details

• Defensible security architecture under pressure
• Architecture assessment, attack-path analysis, and weakness identification
• Tool- and script-based validation of the initial state
• Quickly and thoroughly identifying configuration and architecture changes
• Defensive design changes, validation evidence, and challenge strategy
• Practical application of Zero Trust, identity defense, encryption, telemetry, visibility, deception, and enforcement controls