---
title: "Security, privacy, trust, and threat modeling"
chapter: "22"
---

# Security, privacy, trust, and threat modeling

Secure architecture makes trust boundaries, assets, identities, authority, data flows, threats, controls, and verification explicit. Security is a quality attribute and risk decision, not a perimeter product.

## Core ideas and patterns

| Idea | What it solves | Cost, limit, or warning |
|---|---|---|
| **Least privilege** | Grants only necessary authority for bounded time | Requires usable identity and policy lifecycle |
| **Defense in depth** | Uses independent preventive/detective/recovery controls | Duplicated controls with one failure mode add little |
| **Zero trust** | Continuously verifies identity, device, context, and policy | Does not mean trusting nothing or adding proxies everywhere |
| **Threat modeling/STRIDE** | Systematically asks how design can be abused | Checklists must include business and domain threats |
| **Trust boundary** | Marks where assumptions or authority change | Undrawn boundaries lead to implicit trust |
| **Token exchange/delegation** | Narrows authority across service calls | Audience, lifetime, and impersonation need control |
| **Encryption/tokenization** | Protects confidentiality or replaces sensitive values | Keys, metadata, and access patterns remain |
| **Privacy by design** | Minimizes collection, use, retention, and exposure | Consent does not justify unnecessary data |
| **Audit trail** | Supports accountability and investigation | Logs must be tamper-aware and privacy-safe |

## How to apply it

Inventory assets and data classes. Draw data flows and trust boundaries. Enumerate threats and abuse cases, rank risk, select preventive/detective/recovery controls, and map each to an owner and verification. Design identity for users, workloads, devices, and automation. Separate authentication, authorization, and business invariants.

## Evidence, not opinion

Use architecture review, ASVS/control mapping, authorization matrix tests, secret rotation, attack simulation, dependency/supply-chain controls, audit queries, incident exercises, and deletion verification.

## Small example

The API gateway authenticates a user, but the order service still authorizes the requested order against tenant and ownership. It sends a narrow token to payment; it does not forward a universal bearer credential.

## Feynman check

Explain the design to a new engineer without using the pattern names. State the
problem, the forces that conflict, the chosen boundary or mechanism, what can
fail, and the evidence that would prove the choice still works.