XI. Security Architecture
In a distributed system the network perimeter is not a boundary you can trust — traffic that looks internal may originate from a compromised service, so security must be enforced at every hop rather than at the edge. This part builds that model from identity outward: how services and users authenticate and authorize (OAuth, JWT, RBAC), the zero-trust principle of verifying every request regardless of origin, and the secrets-management and encryption discipline that protects data whether it is moving or at rest.
Topics Covered
Section titled “Topics Covered”- 11.1. Authentication and Authorization: Identity for services and users: OAuth 2.0 and OIDC, JWT, service accounts, and the RBAC and ABAC authorization models.
- 11.2. Zero Trust Architecture: Never trust, always verify: micro-segmentation, identity-aware proxies, BeyondCorp, continuous verification, and policy as code.
- 11.3. Secrets Management and Encryption: Protecting credentials and data: Vault dynamic secrets, envelope encryption, encryption in transit and at rest, and supply-chain security.