استراتيجية عمارة الأمان
في هذه الصفحة 9 موضوعات
نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.
نظرة عامة
الموضوعات
- مشهد التهديدات
- حدود الثقة
- الإعدادات الآمنة الافتراضية
تعلّم أولًا
3.5 ساعة تدريب (تقدير)
مخرجات التعلم
- Assess the organization's threat landscape and map it to architectural controls.
- Define organization-wide trust boundaries and identity strategy for people, services, and partners.
- Build secure defaults into the platform so teams are secure without extra effort.
- Partner with the security team on a multi-year roadmap.
الدروس
- 01استراتيجية الأمان مقابل مراجعات الأمان
- 02مشهد التهديدات لمؤسسة تجارية
- 03حدود الثقة على مستوى المؤسسة
- 04الإعدادات الآمنة الافتراضية في المنصة
- 05أمان سلسلة التوريد على نطاق واسع
- 06خريطة طريق مشتركة مع الأمان
- 07عرض عملي: تحويل خمس ملاحظات تدقيق متكررة إلى إعدادات افتراضية في المنصة
- 08عرض عملي: خريطة حدود الثقة للمؤسسة بأكملها
المختبر والتمارين
Lab
STF-008-LAB1 · Secure by default
Outcomes: 1–4 · Time: ~2.5 h
- Assess the threat landscape for Platform 2.0 and rank the top threats.
- Draw organization-wide trust boundaries and an identity strategy for people, services, and partners.
- Define five secure defaults built into the golden path, each tied to a class of audit findings.
- Draft a multi-year joint roadmap with a role-played CISO.
- Defend the strategy in review.
Acceptance: each default removes a class of findings rather than one finding.
Exercises (case-based; six exercises)
| ID | Outcome | Task |
|---|---|---|
| STF-008-EX01 | 1 | List the top five threats for a marketplace-enabled commerce group and map each to an architectural control. |
| STF-008-EX02 | 2 | Draw a trust-boundary sketch for public edge, services, payments, data, and a partner API; mark controls at each crossing. |
| STF-008-EX03 | 2 | Propose one identity approach for employees, services, and partners, with least-privilege rules. |
| STF-008-EX04 | 3 | Turn "teams commit secrets to repositories" into a platform default; describe enforcement and exception handling. |
| STF-008-EX05 | 3 | Given 40 findings in six classes, choose the three defaults with the biggest reduction and state the expected effect. |
| STF-008-EX06 | 4 | Write a one-page joint roadmap with the security team: roles, year-one goals, measures, and meeting cadence. |
أظهر الحلول
- EX01 Examples: account takeover (rate limits, MFA), payment fraud (isolated payment zone), injection (framework defaults), supply chain (signed artifacts), insider misuse (least privilege and audit).
- EX02 Controls: edge firewall and authentication, mutual authentication between services, payment zone isolation, encrypted data zone with access logging, partner gateway with keys and limits.
- EX03 Central identity provider; workload identities for services; scoped partner credentials; short-lived tokens; review access regularly.
- EX04 Secrets manager in the template, pipeline secret scan that fails the build, logged exceptions with owner and expiry.
- EX05 Pick by counts per class and ease; state findings removed per quarter as the target.
- EX06 Security owns policy and monitoring; platform owns defaults; measures are recurring findings and time to patch; monthly meeting.
Outcome coverage: all four outcomes are covered by exercises and lab.
Workplace evidence: a secure default you introduced at organization level and the findings it eliminated.
الاختبار
Outcomes: O1 threat landscape and controls · O2 trust boundaries and identity · O3 secure defaults · O4 joint roadmap with security.
اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.
الجزء العملي
Six case exercises STF-008-EX01 to EX06 plus the lab, reviewed as a strategy with a role-played CISO. Pass: at least five of six exercises correct, quiz at least 8/10, and a strategy in which each default removes a class of findings.
أخطاء شائعة
Strategy as a list of tools; security work pushed onto every team individually.
التقييم
Strategy review with the CISO role-player.
دليل من بيئة العمل
A secure default you introduced at organization level and the findings it eliminated.
الصلة بالمسار الوظيفي
Security architecture (ARC-028).