The Security Architecture Site
Security Architecture Guidelines and Best Practices
Sound security guidance is often scattered across vendor documentation, conference talks, and forum threads of varying age and accuracy. This site exists to bring that guidance together in one place: a consolidated, practitioner-oriented set of security architecture guidelines spanning application security, endpoint security, identity, cryptography, network security, and data protection — written to be current, technically precise, and immediately actionable.
Alongside the reference material, the site provides a growing collection of tools and utilities intended for direct, practical use — helping engineers and architects assess, configure, and harden the applications and systems they're responsible for, rather than simply reading about how it's done.
Application Security
API Security
Comprehensive guidance on securing APIs aligned to NIST SP 800-204 and SP 800-53, covering authentication, authorisation, rate limiting, input validation, API lifecycle management, and the OWASP API Security Top 10.
Advanced Web Application Firewall
Covers advanced bot protection using TLS/HTTP fingerprinting and behavioural analysis, account takeover detection and response, and client-side protection including CSP, SRI, Trusted Types, and page integrity monitoring.
HTTP User Agents
Defines the four WAF response actions (Allow, Delay, Challenge, Block) and the recommended action for each category of HTTP User-Agent -- browsers, bots, scripting clients, scanners, and mobile apps -- with the reasoning behind each recommendation.
Magic Links
Explains why email-delivered authentication links should generally be prohibited due to phishing risk, and provides hardening controls for the legitimate exceptions (user enrolment, password reset, email verification) where a link-based flow is hard to avoid.
Mutual TLS (mTLS)
Implementation guide for mutual TLS (mTLS) covering CA selection, managed CA services (AWS ACM PCA, HashiCorp Vault, Google CAS), certificate lifecycle management, service mesh enforcement, and NIST SP 800-204A / SP 800-52 alignment.
Nginx Hardening
Hardening guidelines for Nginx covering non-privileged process isolation, TLS configuration, request limits and DoS mitigation, HTTP method restriction, sensitive file protection, reverse proxy trust boundaries, and logging -- aligned to the CIS Nginx Benchmark and NIST SP 800-53.
Penetration Testing
What triggers a penetration test -- regular independent compliance-driven testing and significant architectural changes -- plus a breakdown of testing approaches (black/grey/white-box, network/web/API/cloud/red team) and practical guidelines for scoping, running, and following through on an engagement effectively.
SAST and SCA
Covers Static Application Security Testing (SAST) and Software Composition Analysis (SCA) -- what each finds and misses, phased CI/CD rollout without drowning teams in noise, SBOM generation, and alignment with NIST SP 800-218 (SSDF) and OWASP.
Semgrep (Open Source Edition)
Hands-on guide to the free Semgrep CLI: installation, registry rule sets, offline/local rule usage, diff-aware CI gating without a hosted account (--baseline-commit), writing and testing custom rules (pattern matching, metavariables, taint mode), and the OSS vs Pro engine (intraprocedural vs cross-file) distinction.
Web Application Firewall
Covers WAF deployment modes, negative and positive security models, OWASP CRS, tuning methodology, bypass techniques, origin protection, rate limiting, and DevSecOps integration.
Web Server Hardening
Covers web server hardening for Nginx and Apache including TLS configuration, HTTP security headers, Content Security Policy, method restrictions, directory listing, request limits, rate limiting, error handling, and logging.
Artificial Intelligence
AI Model Security Assessment
A structured framework for assessing AI model security -- provenance and supply chain, training data integrity, weight protection, adversarial robustness, extraction resistance, and deployment monitoring -- aligned to the NIST AI RMF, NIST AI 600-1, NIST SP 800-218A, NIST SP 800-53, and MITRE ATLAS.
MCP Security Assessment
A structured framework for security teams reviewing MCP server integration requests -- identity/least privilege, tool and data-flow risk, supply chain provenance, transport security, and logging -- aligned to the NIST AI RMF, NIST AI 600-1, NIST SP 800-53, and the OWASP Top 10 for LLM Applications.
Cloud Security
Cryptography
Encryption
A comprehensive guide to encryption principles, algorithms, key management, and best practices for security architects.
Post-Quantum Cryptography
Covers the quantum threat model (Shor/Grover, harvest-now-decrypt-later), the NIST-standardized PQC algorithms (ML-KEM/FIPS 203, ML-DSA/FIPS 204, SLH-DSA/FIPS 205), hybrid deployment as the migration-era default, practical migration planning, and current regulatory timelines (NIST IR 8547, Executive Order 14412, NSA CNSA 2.0).
SSL/TLS Certificates
Covers certificate validation levels, dedicated vs wildcard vs multi-domain SAN certificates, when to use each, lifecycle management, private key security, revocation, and internal PKI.
Windows Server Certificate Authority (AD CS)
Design, deploy, and harden an Active Directory Certificate Services (AD CS) PKI hierarchy — covering CA topology, certificate templates, CDP/AIA, CRL/OCSP, auto-enrollment, NDES, auditing, backup, and security hardening.
Data Security
Databases
Database Encryption in SQL Server
A deep dive on SQL Server encryption -- Transparent Data Encryption (TDE) for whole-database protection at rest, native cell-level column encryption, and Always Encrypted for client-side, DBA-proof column protection -- including the shared key hierarchy, deterministic vs. randomized encryption, secure enclaves, and key/certificate management.
SQL Server Hardening
Hardening guidelines for Microsoft SQL Server covering surface area reduction, authentication and least-privilege authorization, network encryption, TDE and backup encryption, auditing, service accounts, patch management, and backup security -- aligned to CIS Benchmarks and NIST SP 800-53.
Endpoint Security
Application Control
Vendor-agnostic guidance on application control (allowlisting): trust models (hash, publisher, path, reputation), full scope beyond executables (libraries, scripts, drivers), phased deployment methodology, common bypass techniques, and alignment with the ACSC Essential Eight maturity model and NIST SP 800-53 CM-7(5).
CrowdStrike Falcon: Configuration & Settings
A practitioner reference for deploying and hardening CrowdStrike Falcon — covering sensor deployment, prevention policy tuning, detection policy settings, device control, firewall management, identity protection, and operational best practices.
Endpoint Detection and Response (EDR)
A comprehensive guide to Endpoint Detection and Response (EDR): core capabilities, architecture, detection techniques including MITRE ATT&CK alignment and LotL detection, response actions, and deployment best practices.
ThreatLocker: Application Control Configuration
Practitioner reference for ThreatLocker as an application control platform -- Application Definitions (hash/certificate/path), Maintenance Modes for phased rollout, Ringfencing, Storage Control, Network Control, Elevation Control, Detect, and the Approval Request workflow -- cross-referenced to the vendor-agnostic Application Control article and ACSC Essential Eight alignment.
Windows Server Hardening
A comprehensive guide to hardening Windows Server installations covering minimal install, account security, network protocol hardening, credential protection, audit logging, and domain controller-specific controls.
Windows Workstation Hardening
A layered approach to hardening Windows workstations covering BitLocker, Credential Guard, application control, and audit logging.
Frameworks
Identity
Customer Identity
Covers the full customer identity lifecycle -- registration, verification, ongoing authentication, session and consent management, account recovery, and de-registration -- with secure registration guidance that defers to the Passwords and Multi-Factor Authentication articles, and deletion guidance aligned to GDPR/CCPA erasure obligations.
Multi-Factor Authentication (MFA)
Ranks MFA factors from FIDO2/passkeys down to SMS OTP by real-world phishing and fatigue resistance, and maps the guidance to NIST SP 800-63B authenticator assurance levels (AAL1-3) and the ACSC Essential Eight MFA maturity model (ML1-3).
Passwords
Covers password requirements, rotation guidance per NIST SP 800-63B, banned/breached password checks, secure storage with Argon2id and bcrypt, account lockout, MFA, and session management.
Network Security
SSH Hardening
Hardening guidelines for OpenSSH covering key-based authentication, MFA, access control, cryptographic algorithm selection, session limits, host key management, and logging -- aligned to CIS Benchmarks and NIST SP 800-53/800-123.
Scanning Hosts and Networks with Nmap
A practical how-to for host discovery, port scanning, service/OS detection, and NSE scripting with nmap, with a dedicated focus on scanning safely -- timing/rate limiting, handling fragile OT/embedded devices, a two-phase discovery-then-deep-scan workflow, and coordinating with security tooling to avoid unplanned incidents.