2.1. System and Network Architecture in Security Operations
💡 First Principle: Security analysts don't build architecture — they inherit it. Understanding the security implications of architectural choices tells you where visibility is strong, where it's weak, and where attackers will exploit the gaps between layers.
Every architectural component creates both a detection opportunity and a blind spot. A well-logged Windows endpoint is a rich source of evidence. A serverless function that doesn't emit application-layer logs is invisible to your SIEM. A Zero Trust network that verifies every access request is far harder to pivot through than a flat network with implicit internal trust.
This matters beyond exam day. In your career, you'll regularly investigate incidents where the answer to "why didn't we detect this?" traces back to an architectural decision — a segment that wasn't instrumented, a cloud workload with no log forwarding, a misconfigured identity provider that issued tokens too broadly. Knowing the security posture each architectural choice implies is the foundational skill.
| Architecture Dimension | Strong Detection Signal | Common Blind Spot |
|---|---|---|
| On-premises | Full control of log sources, network taps | Requires manual integration of each system |
| Cloud (IaaS/PaaS/SaaS) | Native audit logs, CSPM tools (Cloud Security Posture Management) | Default logging often disabled; shared responsibility confusion |
| Hybrid | Widest coverage possible | Identity federation creates cross-environment gaps |
| Flat network | Simple to monitor | Attacker lateral movement is unconstrained once inside |
| Segmented/Zero Trust | Lateral movement is visible and constrained | More complex to configure and maintain |
⚠️ Common Misconception: Zero Trust means "deny everything by default." In practice, Zero Trust means verify everything — authenticated users still access what they need, but the access is explicitly granted and continuously validated, never assumed based on network location alone.
