Security Architecture: Designing Secure Backend Systems

In this tutorial, you will learn about Security Architecture: Designing Secure Backend Systems. We cover key concepts, practical examples, and best practices to help you master this topic.

Security architecture is the practice of designing systems with security built in from the start. It involves threat modeling, data classification, security domain isolation, API Gateway patterns, and selecting appropriate security controls for each layer of the application.

flowchart TB
    subgraph Security Domains
        DMZ[DMZ / Public]
        App[Application Domain]
        Data[Data Domain]
        Admin[Admin Domain]
    end
    
    External[External Users] -->|HTTPS| WAF[WAF / CDN]
    WAF --> API[API Gateway]
    API --> Auth[Authentication Service]
    API --> Service1[Public API Service]
    Service1 --> DB[(Public Database)]
    
    Admin[Admin Users] -->|VPN + MFA| AdminGW[Admin Gateway]
    AdminGW --> AdminService[Admin Service]
    AdminService --> AdminDB[(Admin Database)]
    
    Service1 -.->|mTLS| Internal[Internal Services]
    Internal -.->|Encrypted| DataDB[(Sensitive Data DB)]
    
    DMZ -.-> WAF
    DMZ -.-> API
    App -.-> Service1
    App -.-> Internal
    Data -.-> DataDB
    Data -.-> AdminDB
    Admin -.-> AdminGW
    Admin -.-> AdminService

What You'll Learn

• Threat modeling with STRIDE and attack trees
• Data classification and security domain isolation
• API gateway security patterns
• Security patterns: strangler fig, sidecar, ambassador

Why It Matters

Security cannot be retrofitted effectively. Designing security architecture from the start is 100x cheaper than adding security controls after the system is built. A well-designed security architecture also makes Compliance easier to achieve.

Real-World Use

A healthtech startup designed their architecture with four security domains: public (CDN), application (API services), data (encrypted databases), and admin (VPN-only). Each domain has different authentication requirements and network access controls. This architecture passed HIPAA audit on the first attempt.

Security Architecture Implementation

Threat Modeling with STRIDE

class ThreatModel {
  constructor(systemDescription) {
    this.system = systemDescription;
    this.threats = [];
  }

  analyze() {
    // STRIDE per component
    for (const component of this.system.components) {
      // Spoofing: can someone pretend to be something else?
      if (!component.authentication) {
        this.addThreat('Spoofing', component.name, 'No authentication');
      }

      // Tampering: can data be modified?
      if (!component.integrityCheck) {
        this.addThreat('Tampering', component.name, 'No integrity check');
      }

      // Repudiation: can actions be denied?
      if (!component.auditLogging) {
        this.addThreat('Repudiation', component.name, 'No audit logging');
      }

      // Information Disclosure: can data be exposed?
      if (component.sensitiveData && !component.encryption) {
        this.addThreat('Information Disclosure', component.name, 'No encryption');
      }

      // Denial of Service: can service be overwhelmed?
      if (!component.rateLimit) {
        this.addThreat('Denial of Service', component.name, 'No rate limiting');
      }

      // Elevation of Privilege: can user escalate?
      if (!component.authorization) {
        this.addThreat('Elevation of Privilege', component.name, 'No authorization');
      }
    }

    // Data flow analysis
    for (const flow of this.system.dataFlows) {
      if (!flow.encrypted) {
        this.addThreat('Information Disclosure', flow.name, 'Unencrypted data flow');
      }
      if (!flow.authentication) {
        this.addThreat('Spoofing', flow.name, 'Data flow without auth');
      }
    }

    return this.prioritize();
  }

  addThreat(category, target, description) {
    this.threats.push({
      id: `T-${this.threats.length + 1}`,
      category,
      target,
      description,
      risk: this.calculateRisk(category)
    });
  }

  calculateRisk(category) {
    const riskLevels = {
      'Spoofing': 'HIGH',
      'Tampering': 'HIGH',
      'Repudiation': 'MEDIUM',
      'Information Disclosure': 'CRITICAL',
      'Denial of Service': 'HIGH',
      'Elevation of Privilege': 'CRITICAL'
    };
    return riskLevels[category] || 'MEDIUM';
  }

  prioritize() {
    const order = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
    return this.threats.sort((a, b) => order[a.risk] - order[b.risk]);
  }
}

Expected output:

Threats sorted by risk: 2 CRITICAL (Information Disclosure: unencrypted DB, Elevation of Privilege: missing authZ), 3 HIGH, 1 MEDIUM.

API Gateway Security Patterns

const express = require('express');
const gateway = express.Router();

// Security middleware applied at gateway level
gateway.use(rateLimit({ windowMs: 60000, max: 100 }));
gateway.use(helmet());
gateway.use(authenticateToken);

// Gateway routes with security policies
const routes = [
  {
    path: '/api/public/*',
    methods: ['GET'],
    auth: false,
    rateLimit: 100,
    transform: false
  },
  {
    path: '/api/users/*',
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    auth: true,
    rateLimit: 60,
    transform: true, // Strip sensitive fields
    allowedRoles: ['user', 'admin']
  },
  {
    path: '/api/admin/*',
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    auth: true,
    rateLimit: 30,
    allowedRoles: ['admin'],
    audit: true // Log all admin actions
  },
  {
    path: '/api/internal/*',
    methods: ['GET', 'POST'],
    auth: 'mTLS',
    rateLimit: 1000,
    internalOnly: true
  }
];

function applyRouteSecurity(route) {
  const middleware = [];

  if (route.auth === 'mTLS') {
    middleware.push(authenticateMTLS);
  } else if (route.auth) {
    middleware.push(authenticateToken);
    middleware.push(authorizeRoles(route.allowedRoles));
  }

  if (route.rateLimit) {
    middleware.push(rateLimit({ windowMs: 60000, max: route.rateLimit }));
  }

  if (route.audit) {
    middleware.push(auditRoute);
  }

  if (route.transform) {
    middleware.push(transformResponse);
  }

  return middleware;
}

Expected output:

Gateway enforces per-route security policies: auth, rate limits, role checks, audit logging, and response transformation.

Security Domain Isolation

# docker-compose security domains
version: '3.8'
networks:
  dmz:
    driver: bridge
    internal: false  # Accessible from internet
    ipam:
      config:
        - subnet: 10.0.1.0/24
  
  application:
    driver: bridge
    internal: true   # No external access
    ipam:
      config:
        - subnet: 10.0.2.0/24
  
  data:
    driver: bridge
    internal: true   # Most restricted
    ipam:
      config:
        - subnet: 10.0.3.0/24

services:
  # DMZ layer: public-facing
  nginx:
    image: nginx
    networks:
      - dmz
  
  # Application layer: business logic
  api-gateway:
    image: api-gateway
    networks:
      - dmz
      - application
  
  user-service:
    image: user-service
    networks:
      - application
  
  # Data layer: databases
  postgres:
    image: postgres
    networks:
      - data
    environment:
      - DB_ENCRYPTION_KEY
    
  redis:
    image: redis
    networks:
      - data

Expected output:

DMZ can access application layer. Application layer can access data layer directly.
Data layer is isolated from DMZ. If DMZ is compromised, data layer is not directly accessible.

Common Mistakes

• Not doing threat modeling until after the system is built — threat modeling should inform architecture decisions.
• Putting all services in the same network with no segmentation — a breach in one service exposes all.
• Mixing sensitive and non-sensitive data in the same database — encrypt sensitive data and isolate it.
• Building custom security controls instead of using proven patterns and libraries.
• Assuming the API gateway handles all security — each service should independently enforce security.

Practice Questions

1. What is STRIDE threat modeling?
2. Why is security domain isolation important?
3. What is the role of an API gateway in security architecture?
4. How do you classify data sensitivity?
5. What is the difference between security architecture and security implementation?

Challenge

Design a security architecture for a multi-tenant SaaS platform. Include: (1) threat model with STRIDE, (2) data classification (public, internal, confidential, restricted), (3) network segmentation with 4 security domains, (4) API gateway with per-route security policies, (5) encryption Strategy per data classification.

FAQ

Mini Project

Design the security architecture for a fintech application. Create: (1) data flow diagram with security controls at each flow, (2) threat model identifying top 10 threats, (3) network segmentation plan with 3 domains, (4) API gateway security policies for 5 service categories, (5) encryption strategy for data at rest and in transit.

What's Next

Continue to Security Review to learn about conducting security code reviews.