LESSON 3.8: Capstone – Designing a Security Architecture for a Financial Institution

Introduction: The Culmination of Module 3

In Lessons 3.1 through 3.7, we established the complete theoretical and practical framework for security architecture in financial institutions. We explored the core principles of security architecture, examined network security controls, analyzed secure remote access solutions, investigated network monitoring and SIEM, implemented network segmentation and defense-in-depth strategies, learned from real-world case studies, and developed a comprehensive roadmap planning framework.

This final lesson of Module 3 is the Capstone Project—an exercise in designing a comprehensive security architecture for a financial institution. This project integrates all seven lessons into a single, unified security architecture design.

The capstone project is designed to be a portfolio piece that demonstrates your mastery of security architecture principles for financial institutions. By the end, you will have a complete, production-ready security architecture design that is mathematically rigorous, practical, and applicable to real-world financial institutions.

Learning Objectives

Upon completion of this capstone project, you will be able to:

Integrate all components of Module 3 into a comprehensive security architecture design.
Design a Security Architecture for a financial institution.
Apply the Security Architecture Frameworks: SABSA, TOGAF, and NIST CSF.
Implement the Security Design Patterns: Defense-in-Depth, Zero-Trust, and Micro-Segmentation.
Develop a Security Architecture Roadmap for the financial institution.
Present the security architecture design to stakeholders.

Part 1: The Capstone Scenario

1.1 Scenario Description

You are the Chief Information Security Officer (CISO) of Global Financial Institution (GFI) , a mid-sized financial institution with the following characteristics:

Employees: 5,000 employees across 10 countries
Customers: 2 million retail customers and 10,000 corporate clients
Assets: $100 billion in assets under management
Operations: Retail banking, corporate banking, wealth management, and capital markets
Technology: Hybrid cloud (AWS, Azure, and on-premises data centers)
Regulatory Requirements: GLBA, SOX, GDPR, NYDFS, and PCI DSS

1.2 The Architecture Challenge

GFI has experienced a series of cybersecurity incidents in the past year, and the CEO and Board have requested a comprehensive security architecture design. The design must:

Protect all critical assets and data
Comply with all regulatory requirements
Enable secure remote work and business continuity
Detect and respond to threats in real-time
Scale with the organization’s growth
Be cost-effective and practical to implement

Part 2: The Security Architecture Design

2.1 Architecture Framework Selection

Selected Framework: NIST Cybersecurity Framework (CSF) integrated with SABSA for business alignment.

$Architecture Framework = NIST CSF + SABSA$

Rationale:

NIST CSF provides a comprehensive cybersecurity framework
SABSA ensures business alignment
Both frameworks are widely adopted in financial institutions

2.2 The Architecture Components

Component	Description	Implementation
Perimeter Security	Firewalls, IPS, DDoS Protection	NGFW, cloud WAF, DDoS mitigation
Network Security	Network segmentation, VLANs, micro-segmentation	Trust zones, ZTNA, micro-segmentation
Endpoint Security	EDR, antivirus, application control	EDR platform, endpoint protection
Application Security	WAF, secure coding, vulnerability scanning	WAF, DevSecOps, SAST/DAST
Data Security	Encryption, DLP, access controls	Data encryption, DLP, IAM
Monitoring	SIEM, network monitoring, threat hunting	SIEM platform, SOC, threat intelligence
Incident Response	IR plan, forensics, communication	IR team, incident response playbooks
Business Continuity	BCP, DR, redundancy	Cloud DR, business continuity planning

2.3 Architecture Design Deliverables

Deliverable 1: Security Architecture Diagram

Security Architecture Diagram (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Perimeter Security Layer                                          ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  NGFW │ IPS │ DDoS Protection │ Web Application Firewall    │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Network Security Layer                                            ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  Network Segmentation │ VLANs │ Micro-Segmentation │ ZTNA   │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Endpoint Security Layer                                          ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  EDR │ Antivirus │ Application Control │ Patch Management   │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Application Security Layer                                       ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  Secure Coding │ SAST/DAST │ API Security │ DevSecOps        │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Data Security Layer                                              ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  Encryption │ DLP │ IAM │ Privileged Access Management      │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Monitoring and Response Layer                                   ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  SIEM │ Network Monitoring │ Threat Hunting │ SOC            │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                  │                                      │
|  ┌─────────────────────────────────────────────────────────────────────┐│
|  │  Business Continuity Layer                                        ││
|  │  ┌───────────────────────────────────────────────────────────────┐││
|  │  │  BCP │ Disaster Recovery │ Cloud DR │ Redundancy            │││
|  │  └───────────────────────────────────────────────────────────────┘││
|  └─────────────────────────────────────────────────────────────────────┘│
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 3: Implementation Roadmap

3.1 Roadmap Timeline

Phase	Duration	Key Initiatives
Phase 1: Foundation	Q1-Q2 2025	NGFW deployment, ZTNA pilot, SOC establishment
Phase 2: Expansion	Q3-Q4 2025	Micro-segmentation, SIEM upgrade, DLP implementation
Phase 3: Optimization	Q1-Q2 2026	Advanced threat detection, zero-trust expansion, automation
Phase 4: Maturity	Q3-Q4 2026	Continuous monitoring, threat hunting, maturity assessment

3.2 Resource Requirements

Phase	Budget	Personnel	Technology
Phase 1: Foundation	$2,000,000	5 FTEs	NGFW, ZTNA, SOC tools
Phase 2: Expansion	$1,500,000	8 FTEs	Micro-segmentation, SIEM, DLP
Phase 3: Optimization	$1,000,000	6 FTEs	Advanced threat detection, automation
Phase 4: Maturity	$500,000	4 FTEs	Continuous monitoring, threat hunting

Part 4: Evaluation Criteria

4.1 Assessment Criteria

Criteria	Weight	Description
Completeness	25%	All components are addressed
Correctness	25%	The architecture is technically correct
Practicality	20%	The architecture is practical and implementable
Regulatory Compliance	15%	The architecture meets regulatory requirements
Presentation	15%	The architecture is clearly presented and documented

Module 3 Conclusion

Module 3 Recap

Lesson	Core Competency	Key Mathematical Result
3.1	Security Architecture Foundations	$M_{S A} = α \cdot A_{w a re n ess} + β \cdot D_{es i g n} + γ \cdot I_{m pl e m e n t a t i o n} + δ \cdot O_{p er a t i o n}$
3.2	Firewalls and IDS/IPS	$F_{r u l es} = {Source, Destination, Service, Action}$
3.3	Secure Remote Access and VPNs	$V_{PN} = {Confidentiality, Integrity, Authentication, Authorization}$
3.4	Network Monitoring and SIEM	$E_{S I EM} = C_{o ll ec t i o n} \times C_{orre l a t i o n} \times A_{l er t in g} \times R e p or t in g$
3.5	Network Segmentation and Defense-in-Depth	$S_{e ff} = I_{so l a t i o n} \times C_{o n t ro l} \times M_{ana g e abi l i t y}$
3.6	Case Studies and Best Practices	$Lessons Learned = Segmentation + Privileged Access + Third-Party Risk$
3.7	Implementation and Roadmap Planning	$P_{ini t} = R_{i s k} \times B_{u s in ess Va l u e} \times F_{e a s ibi l i t y}$
3.8	Capstone	Comprehensive Security Architecture Design

Certificate in Cybersecurity for Financial Institutions LESSON 3.8: Capstone – Designing a Security Architecture for a Financial Institution

Certificate in Cybersecurity for Financial Institutions