Security Architecture Review Methodology
A structured methodology for conducting security architecture reviews, from data flow mapping to threat modeling and control gap analysis.
Security architecture review is a structured evaluation of how security controls are designed and integrated across an entire system, application, or infrastructure environment, rather than testing individual controls in isolation. For CISA candidates, understanding this holistic review methodology complements the more granular control-testing approaches covered elsewhere in the exam, providing the bigger-picture lens auditors need when assessing whether a security design is fundamentally sound.
Step One: Define Scope and Gather Documentation
A security architecture review begins by clearly defining the boundary of the system or environment under review and gathering existing architecture documentation, including network diagrams, data flow diagrams, system interconnection agreements, and any existing threat models. Where documentation is outdated or incomplete, which is common, the review itself often becomes an opportunity to rebuild an accurate, current picture of the environment.
Step Two: Map Data Flows and Trust Boundaries
A central activity is mapping how data flows through the system, from initial input or ingestion through processing, storage, and eventual output or transmission to external parties. Each point where data crosses a trust boundary, moving between differently trusted zones such as from the public internet into a DMZ, or from a DMZ into an internal network, represents a critical control point requiring scrutiny. Auditors should identify what security controls (firewalls, application gateways, encryption, authentication checkpoints) exist at each trust boundary crossing.
Step Three: Threat Modeling
Threat modeling systematically identifies potential threats and attack vectors against the architecture, commonly using structured frameworks such as STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) to ensure comprehensive coverage across threat categories. For each identified threat, the review assesses whether an existing control mitigates it, whether the mitigation is sufficient given the sensitivity of the data or criticality of the function involved, and where gaps exist.
Common Architecture Weaknesses Identified
- Flat network architecture lacking meaningful segmentation between systems of differing sensitivity
- Overreliance on perimeter defenses with insufficient internal controls, leaving the environment vulnerable once perimeter defenses are breached
- Single points of failure in authentication or logging infrastructure
- Excessive trust granted to third-party integrations without adequate validation of data received from them
- Encryption applied in transit but missing at rest, or vice versa, for sensitive data stores
Step Four: Control Gap Analysis
Building on the threat model, the review compares the architecture's actual control implementation against a recognized baseline or framework, such as NIST SP 800-53, the CIS Critical Security Controls, or an internal security architecture standard, to identify gaps between the required and actual control posture. This comparison should be risk-weighted, prioritizing gaps affecting the most sensitive data or most critical business functions.
Step Five: Defense in Depth Assessment
A key evaluation criterion is whether the architecture demonstrates genuine defense in depth, meaning multiple independent layers of control such that the failure of any single control does not result in complete compromise. Reviewers should be skeptical of architectures relying heavily on a single strong control (such as a well-configured firewall) without meaningful compensating layers behind it.
Step Six: Reporting and Remediation Roadmap
Findings from a security architecture review are typically more strategic and structural than findings from a compliance-focused control test, often requiring significant remediation effort such as network redesign, re-architecting authentication flows, or implementing new segmentation. Effective reporting therefore includes a prioritized, risk-ranked roadmap rather than a simple list of point-in-time findings, recognizing that architectural change takes considerably longer to implement than a configuration fix.
Exam Relevance
CISA candidates should understand security architecture review as a distinct, holistic methodology combining data flow mapping, trust boundary analysis, structured threat modeling, and framework-based gap analysis, providing assurance over the fundamental soundness of a security design rather than merely confirming individual controls are configured correctly in isolation.