Chapter 3: Cyber Security Design and Architecture

A resilient cyber security posture cannot rely upon a single perimeter firewall or security barrier. Adversaries continuously evolve techniques to bypass perimeter defenses. Consequently, robust enterprise cybersecurity architecture is built upon two complementary paradigms: Defence-in-Depth and Zero Trust Architecture (ZTA).

                         DEFENCE-IN-DEPTH: THE 7 LAYERS
                                        │
           ┌────────────────────────────┼────────────────────────────┐
           ▼                            ▼                            ▼
  [ 1. Physical Layer ]        [ 2. Perimeter Layer ]       [ 3. Network Layer ]
  - Biometric access           - DDoS scrubbing             - VLAN segmentation
  - CCTV / Server locks        - Next-Gen Firewalls         - IDS / IPS sensors
           │                            │                            │
           └────────────────────────────┼────────────────────────────┘
                                        ▼
                               [ 4. Endpoint Layer ]
                               - EDR / Antivirus
                               - Host firewalls / FIM
                                        │
           ┌────────────────────────────┼────────────────────────────┐
           ▼                            ▼                            ▼
 [ 5. Application Layer ]      [ 6. Data Layer ]            [ 7. Human Layer ]
 - WAF / RASP                  - AES-256 encryption         - Phishing training
 - Secure SDLC                 - DLP / Tokenisation         - Background checks

The Defence-in-Depth Paradigm

Defence-in-Depth is an architectural strategy that deploys multiple, overlapping security controls across every technological and physical layer of an enterprise. If an attacker breaches one protective mechanism, subsequent defensive layers automatically contain, delay, and alert on the intrusion:

1. Physical Layer: Securing physical facilities, server rooms, and telecommunications closets using biometric badge readers, man-traps, 24/7 CCTV surveillance, and environmental controls.
2. Perimeter Layer: Cloud-based distributed denial-of-service (DDoS) mitigation shields, external border routers, and Next-Generation Firewalls (NGFW) filtering external traffic.
3. Internal Network Layer: Internal firewalls, virtual local area networks (VLANs), network intrusion detection and prevention systems (NIDS/NIPS), and 802.1X port authentication.
4. Host / Endpoint Layer: Endpoint Detection and Response (EDR), host-based firewalls, automated patch management, and File Integrity Monitoring (FIM).
5. Application Layer: Web Application Firewalls (WAF), Runtime Application Self-Protection (RASP), API gateways, and rigorous input sanitization.
6. Data Layer: Cryptographic protection (AES-256 at rest, TLS 1.3 in transit), dynamic database masking, Data Loss Prevention (DLP), and fine-grained access policies.
7. Human / Operational Layer: Security awareness training, privileged user vetting, clean desk policies, and incident response runbooks.

---

Zero Trust Architecture (ZTA): NIST SP 800-207

The traditional "castle-and-moat" security model assumed that anyone inside the corporate intranet was inherently trustworthy. Modern cloud architectures, remote workforces, and sophisticated insider threats have rendered this perimeter-centric assumption obsolete.

Zero Trust Architecture operates on a single core operational maxim: "Never Trust, Always Verify." Under ZTA, no user, device, application, or network packet is granted implicit trust based solely on physical location or network topology.

                     NIST SP 800-207 ZERO TRUST LOGICAL ARCHITECTURE
                                            │
                       [ SUBJECT / USER & DEVICE ]
                                            │
                                            ▼
                           [ POLICY ENFORCEMENT POINT (PEP) ]
                               (Gateway / Proxy / Agent)
                                            │
                      ┌─────────────────────┴─────────────────────┐
                      ▼                                           ▼
         [ POLICY ENGINE (PE) ]                      [ POLICY ADMINISTRATOR (PA) ]
         - Evaluates Access Request                  - Generates / Revokes Credentials
         - Calculates Dynamic Trust Score            - Commands PEP to grant/block access
                      │                                           │
                      └─────────────────────┬─────────────────────┘
                                            ▼
                          [ ENTERPRISE RESOURCE / DATA ]

The Three Foundational Pillars of Zero Trust:

1. Verify Explicitly: Authenticate and authorize every access attempt based on all available data points—including user identity, geographic location, device security health, service context, and data classification.
2. Use Least Privilege Access: Restrict user access using Just-In-Time (JIT) and Just-Enough-Access (JEA) models, dynamic risk-based adaptive policies, and data protection controls.
3. Assume Breach: Operate continuously under the assumption that adversaries are already inside the internal network. Minimize blast radius by segmenting networks, encrypting all internal traffic, and utilizing automated threat detection.

In financial trading architectures, unsegmented "flat" networks are catastrophic: an attacker compromising a single user workstation or printer can move laterally across the entire enterprise to access core settlement databases or trading engines. Network segmentation divides a broader network into smaller, isolated, and strictly policed subnetworks to contain intrusions and enforce granular boundary protections.

                      TRADITIONAL MULTI-TIER DMZ ARCHITECTURE
                                         │
                                [ PUBLIC INTERNET ]
                                         │
                                [ EXTERNAL FIREWALL ]
                                         │
                   ┌─────────────────────┴─────────────────────┐
                   ▼                                           ▼
          [ DEMILITARISED ZONE (DMZ) ]               [ OUTSIDE SERVICES ]
          - Public Web Servers                       - DNS / Reverse Proxy
          - External Mail Gateways                   - Public API Gateway
                   │                                           │
                   └─────────────────────┬─────────────────────┘
                                         ▼
                                [ INTERNAL FIREWALL ]
                                         │
                   ┌─────────────────────┴─────────────────────┐
                   ▼                                           ▼
          [ APPLICATION TIER ]                        [ DATABASE TIER ]
          - Core Trading Engines                      - Customer Account Records
          - Order Processing                          - Encrypted Transaction Logs

1. The Demilitarised Zone (DMZ)

A Demilitarised Zone (DMZ) is a perimeter network segment that exposes an organization's external-facing services (such as public web servers, API gateways, reverse proxies, and external mail relays) to the untrusted public internet while isolating the sensitive internal corporate intranet.

• Dual-Firewall Architecture: The DMZ is typically flanked by two independent firewalls (an External Perimeter Firewall and an Internal Security Firewall), often sourced from different hardware vendors to prevent a single zero-day vulnerability from compromising both barriers.
• Traffic Directionality Rules: Public traffic is permitted only into the DMZ. Direct inbound connections from the public internet to the internal application or database tiers are strictly forbidden. Furthermore, DMZ servers cannot initiate connections into the internal network; internal application servers must poll the DMZ for outbound requests.

2. Network Segmentation vs Microsegmentation

3. Boundary Protection Technologies

• Next-Generation Firewalls (NGFW): Unlike legacy packet filters that inspect only IP headers and ports, NGFWs perform deep packet inspection (DPI) at the application layer (OSI Layer 7). They detect and block evasive applications, decrypt and inspect SSL/TLS sessions, integrate real-time threat intelligence feeds, and identify malicious payloads.
• Intrusion Detection Systems (IDS) & Intrusion Prevention Systems (IPS):
  • IDS (Passive): Monitored via SPAN/mirror ports; analyzes network packets against signature databases and behavioural baselines to alert security analysts of potential intrusions without altering packet flows.
  • IPS (Active / Inline): Placed directly in the network traffic path; actively terminates malicious TCP connections, drops unauthorized packets, and dynamically reconfigures firewalls to shun attacking IP addresses.
• Web Application Firewalls (WAF): Specialized Layer 7 appliances positioned in front of web applications and APIs. They analyze HTTP/HTTPS traffic to prevent application-specific attacks such as SQL injection, Cross-Site Scripting (XSS), and zero-day web exploits.
• Bastion Hosts and Jump Boxes: Hardened, multi-factor-authenticated gateway servers that provide the sole authorized pathway for system engineers to manage internal production infrastructure remotely.

Cryptographic architecture forms the mathematical underpinning of modern digital trust. It guarantees data confidentiality, enforces message integrity, establishes mutual authentication, and creates legally binding digital signatures for capital market operations in the GIFT IFSC.

                      SYMMETRIC VS ASYMMETRIC CRYPTOGRAPHY
                                       │
         ┌─────────────────────────────┴─────────────────────────────┐
         ▼                                                           ▼
[ SYMMETRIC ENCRYPTION ]                                    [ ASYMMETRIC ENCRYPTION ]
- Single Shared Secret Key                                  - Mathematically Linked Key Pair:
- High computational speed                                    • Public Key (Widely shared)
- Ideal for bulk data at-rest & in-transit                    • Private Key (Strictly guarded secret)
- Standards: AES-256, ChaCha20                              - Enables key exchange & digital signatures
                                                            - Standards: RSA-4096, ECC (secp256r1)

1. Symmetric vs Asymmetric Cryptographic Primitives

1. Symmetric Encryption:
   • Uses the identical secret key for both data encryption and decryption.
   • Characterized by exceptional execution speed and low computational overhead, making it ideal for encrypting high-volume database storage, virtual machine disks, and high-throughput network tunnels.
   • Benchmark Standard: Advanced Encryption Standard with a 256-bit key (AES-256), operating in Galois/Counter Mode (GCM) to deliver authenticated encryption.
2. Asymmetric (Public Key) Encryption:
   • Employs a mathematically bound key pair: a Public Key (which can be disseminated openly to the world) and a Private Key (which must be guarded as a closely held secret in secure hardware).
   • Solves the critical problem of secure key distribution across untrusted public networks.
   • Primary Use Cases: Session key exchange (Diffie-Hellman), digital certificates, and digital signatures.
   • Benchmark Standards: RSA (minimum 2048-bit, recommended 4096-bit) and Elliptic Curve Cryptography (ECC, e.g., secp256r1 / Ed25519), which achieves equivalent cryptographic strength with substantially smaller key sizes.

2. Public Key Infrastructure (PKI) and Digital Signatures

A Public Key Infrastructure (PKI) is the comprehensive framework of hardware, software, policies, and legal procedures required to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption:

• Certificate Authority (CA): The trusted third-party entity that cryptographically signs and issues digital certificates, binding an entity’s verified legal identity to its public key.
• Registration Authority (RA): Verifies the legal identity and credentials of applicants before requesting the CA to generate a certificate.
• Certificate Revocation List (CRL) & Online Certificate Status Protocol (OCSP): Real-time mechanisms to verify whether a digital certificate has been compromised or revoked prior to its scheduled expiration.
• Hardware Security Modules (HSMs): Physical, tamper-resistant cryptographic hardware appliances (certified to FIPS 140-2/3 Level 3 or 4) used to generate, store, and manage master CA private keys and critical banking encryption keys.

---

3. Secure Remote Access Architecture: VPNs, SASE, and ZTNA

The proliferation of hybrid cloud computing and remote working requires secure, encrypted communication pathways between users, distributed branch offices, and core data center systems: