Security

Security in system design is the practice of protecting systems, data, and users from threats. It is not a feature added at the end; it is an emergent property of architecture, code, processes, and culture. A secure system assumes breach and limits damage through defense in depth.

This guide covers the security layers that matter in distributed systems: threat modeling, network controls, web application firewalls, DDoS mitigation, encryption, identity, and zero trust. The goal is not to make you a security specialist, but to ensure you can design systems that are resilient by default.

Security and usability are often in tension. The best security designs make the right thing easy and the wrong thing hard, without adding friction that drives users to work around controls.

Threat modeling is a structured way to identify, quantify, and address security risks. The STRIDE model is a common framework: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Defense in depth means layering security controls so that a single failure does not lead to compromise. If one layer is bypassed, the next layer provides protection. No single control is perfect; together they raise the cost of attack.

A Web Application Firewall (WAF) inspects HTTP traffic and blocks malicious requests. It protects against common attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). A WAF is a valuable layer but not a substitute for secure application code.

Distributed Denial of Service (DDoS) attacks overwhelm a system with traffic, making it unavailable to legitimate users. Mitigation happens at multiple layers: DNS, network, transport, and application. Cloud providers and CDNs offer scrubbing services that absorb and filter attack traffic.

Encryption protects data from unauthorized access. Data in transit should use TLS 1.2 or higher. Data at rest should be encrypted using strong algorithms and key management. Encryption ensures that even if an attacker gains access to storage or network traffic, they cannot read the data without the keys.

Encryption in Transit

Use TLS for all public and internal service communication. Terminate TLS at the load balancer or gateway, and use mTLS between services for mutual authentication. Disable weak ciphers and enforce HSTS for browser clients.

Encryption at Rest

Encrypt databases, object storage, backups, and logs at rest. Use managed keys from a KMS where possible, and rotate keys periodically. For highly sensitive data, consider application-level encryption so that the database layer never sees plaintext.

Identity and access management (IAM) controls who can do what. Authentication verifies identity. Authorization determines what actions an identity can perform. Both should be explicit, auditable, and based on least privilege.

Zero trust assumes that no user, device, or service should be trusted by default, regardless of network location. Every access request is authenticated, authorized, and encrypted. This model replaces the traditional perimeter-based security model, which treats internal traffic as safe.

A checklist cannot replace threat modeling, but it helps catch common oversights. Review this list before shipping any system design.

Security must be embedded into the software development lifecycle, not bolted on before release. A secure SDLC includes threat modeling, code review, automated scanning, and incident response planning.