JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV INFORMATION SECURITY Previous Question Paper (October/November - 2020 - R15)

Designing a security architecture involves creating a structured framework that integrates security controls into an organization's IT infrastructure to protect assets from threats. The process follows a layered approach, often visualized as a series of concentric circles or a defense-in-depth model.

The architecture design process includes the following key phases:

1. Requirement Analysis: Identifying critical assets, conducting risk assessments, and defining security policies based on business objectives.
2. Security Domain Definition: Segmenting the network into logical zones (e.g., DMZ, internal network, management zone) to isolate sensitive data.
3. Control Selection: Implementing technical, administrative, and physical controls such as firewalls, IDS/IPS, encryption, and access control mechanisms.
4. Integration and Monitoring: Deploying security information and event management (SIEM) systems to provide centralized visibility and incident response capabilities.

In a typical architectural diagram, the Defense-in-Depth model is represented by layers: the outermost layer consists of perimeter security (firewalls, routers), followed by network security (VLANs, segmentation), host security (endpoint protection), application security (WAF, secure coding), and finally, data security (encryption, database access controls). This layered approach ensures that if one control fails, others remain to mitigate the risk.

The need for security arises from the increasing reliance on digital systems for critical operations and the evolving landscape of cyber threats. Security is essential to maintain the CIA Triad:

1. Confidentiality: Ensuring that sensitive information is accessible only to authorized individuals, preventing unauthorized disclosure or data breaches.
2. Integrity: Protecting data from unauthorized modification, ensuring that information remains accurate, consistent, and trustworthy throughout its lifecycle.
3. Availability: Guaranteeing that systems, applications, and data are accessible to authorized users when needed, protecting against denial-of-service attacks or system failures.

Beyond the CIA triad, security is necessary to ensure non-repudiation (proving the origin and integrity of a transaction), regulatory compliance (adhering to legal standards like GDPR or HIPAA), and maintaining organizational reputation. Without robust security, organizations face significant financial loss, legal liability, and loss of customer trust.