“Create a secure web application architecture with users, WAF and SSO, a web app, an API, an encrypted database, and an audit log.”
Leggi le decisioni che ne stanno alla base.
Place WAF and SSO before application traffic.
Show the web app and API separately.
Mark the application database as encrypted.
Send edge activity to an audit log.
Use this as a first security architecture view before a detailed threat model.
Domande frequenti
What should a secure web architecture show?
Show the public entry point, identity controls, application services, data stores and audit or monitoring path.
Why put WAF and SSO at the edge?
They provide a clear control point before requests reach the application.
What is an audit log for?
It records security-relevant activity for investigation and operational review.