Architecture and strategy
Security architecture has moved from walls to identity to a shared fabric of controls, and is now moving towards systems that sense and act on risk by themselves. Most organisations run several stages at once, so the work is deciding which part of the estate needs which stage.
New to this? The simple version
Field notes
- Post-quantum migration starts with a cryptography inventory
The new quantum-safe algorithms are standard and the deadlines are set: 2028 to know what you have, 2035 to finish. The hard part is not the maths. It is finding every place an organisation uses cryptography, and most cannot list them yet.
- Security runs on pub-sub: the mesh, the logs and the monitoring
Most of what makes a security architecture work is one pattern in disguise, publish and subscribe. Seeing it explains why logging, monitoring and the mesh succeed or fail together.
- Where security architecture stands, and why most organisations run several at once
Security architecture has moved through seven stages, from ad hoc to AI-native. Most organisations live in several at once, and that mix is the real starting point.
Tools
- The Ascent of Security Architecture
Seven stages from ad hoc to AI-native, on the home page.
Personal work and my own view, not my employer's. Sources are public.