01 / ON-PREMISES
Control the estate.
Separate the edge, workloads and data. Keep administration on its own network and protect the hardware itself.
DEFENCE IN DEPTH / INTERACTIVE FIELD GUIDE
One layer is never enough.
Follow a request from the edge to recovery across on-premises, cloud and hybrid estates. Then switch a layer off and see which of the others still holds.
CLOUD / REFERENCE ARCHITECTURE
A connected system of defence
12 layers working together
Select a component to inspect it.
Data path
Security telemetry
Trust boundary
Switched off
TRACE A JOURNEY
READY
Choose a journey and trace how the layers respond.
SAME PRINCIPLES, DIFFERENT BOUNDARIES
Location changes the implementation, not the need.
02 / CLOUD
Identity is the perimeter.
Private workloads, short-lived identities and policy as code. Write down who owns each side of the service boundary.
03 / HYBRID
Join systems, keep boundaries.
Federate identity and encrypt the interconnect. A private route gives reachability; it does not grant trust.
Architecture review: the questions worth asking
01 Know your assets
Map owners, data sensitivity, dependencies and trust boundaries before choosing controls.
02 Plan for compromise
Limit lateral movement, separate administration and make security logs hard to tamper with.
03 Prove recovery
Agree recovery time and point objectives, then restore into an isolated environment to prove them.
04 Test the design
Threat model the real flows and rehearse incident response. A diagram is where review starts.
ABOUT THIS LAB
Simplified on purpose.
These flows are teaching models with the vendor names stripped out, so the reasoning carries across estates. They are not a design approval or a live assessment.
Built and maintained by Saleem Yousaf, cloud and cyber security architect and director of Cyber Spartans Ltd. Nothing you click here leaves your browser.