LESSON 3: SECURITY ARCHITECTURE AND ZERO TRUST IN BANKING

SECTION 1: LEARNING OBJECTIVES

By the end of this lesson, you will be able to:

Understand the principles of security architecture in digital banking.
Define Zero Trust Architecture (ZTA) and its core principles.
Implement network security – segmentation, firewalls, and intrusion detection.
Apply cloud security best practices in banking.
Understand secure remote access and VPN alternatives.
Implement security monitoring and threat detection.
Measure security architecture effectiveness using key metrics.
Develop a security architecture strategy for a digital bank.

SECTION 2: SECURITY ARCHITECTURE PRINCIPLES

2.1 Core Security Architecture Principles

Principle	Description	Banking Application
Defence in Depth	Multiple layers of security.	Firewall + IDS + encryption + access controls.
Least Privilege	Minimum required access.	Role-based access, just-in-time access.
Fail Secure	Fail to a secure state.	Deny access on failure.
Separation of Duties	No single person has all control.	Segregation in payment approvals.
Security by Design	Build security in from the start.	Secure development lifecycle.
Zero Trust	Never trust, always verify.	Continuous authentication, micro-segmentation.

2.2 Security Architecture Layers

┌─────────────────────────────────────────────────────────────────────────────┐
│                    SECURITY ARCHITECTURE LAYERS                           │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    APPLICATION LAYER                                │   │
│  │  Secure coding, application firewalls, API security                 │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DATA LAYER                                       │   │
│  │  Encryption, data masking, DLP, backup                             │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    NETWORK LAYER                                   │   │
│  │  Firewalls, segmentation, IDS/IPS, secure access                    │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    ENDPOINT LAYER                                   │   │
│  │  Endpoint protection, patching, device management                   │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    IDENTITY LAYER                                   │   │
│  │  IAM, MFA, SSO, privileged access management                       │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

SECTION 3: ZERO TRUST ARCHITECTURE (ZTA)

3.1 What is Zero Trust?

Zero Trust is a security model that assumes no user, device, or network is inherently trusted – even if inside the corporate network. Every access request must be verified, authenticated, and authorised.

3.2 Zero Trust Principles

Principle	Description	Implementation
Verify Explicitly	Always authenticate and authorise.	MFA, continuous authentication.
Least Privilege	Minimum access required.	Just-in-time access, RBAC.
Assume Breach	Design as if breached.	Segmentation, monitoring.
Micro-Segmentation	Isolate workloads.	Network segmentation, Zero Trust Network Access.
Continuous Monitoring	Monitor all traffic.	Logging, analytics, threat detection.
Data-Centric Security	Protect data, not just perimeter.	Encryption, DLP.

3.3 Zero Trust Architecture Components

┌─────────────────────────────────────────────────────────────────────────────┐
│                    ZERO TRUST ARCHITECTURE                                │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    IDENTITY LAYER                                   │   │
│  │  IAM, MFA, SSO, Privileged Access                                   │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    POLICY ENGINE                                    │   │
│  │  Access policies, risk scoring, dynamic policy enforcement          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    MICRO-SEGMENTATION                               │   │
│  │  Network segmentation, workload isolation, zero-trust network       │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DATA PROTECTION                                  │   │
│  │  Encryption, data classification, DLP                              │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    MONITORING & ANALYTICS                           │   │
│  │  Logging, threat detection, SIEM, analytics                         │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

SECTION 4: NETWORK SECURITY

4.1 Network Security Components

Component	Description	Banking Application
Firewalls	Filter traffic based on rules.	Perimeter and internal firewalls.
IDS/IPS	Detect and prevent intrusions.	Network and host-based IDS.
Network Segmentation	Isolate network segments.	DMZ, internal segmentation.
VPN	Secure remote access.	Remote employee access.
Zero Trust Network Access	Secure application access.	Instead of VPN.
DDoS Protection	Mitigate DDoS attacks.	Cloud-based DDoS protection.

4.2 Network Segmentation in Banking

┌─────────────────────────────────────────────────────────────────────────────┐
│                    NETWORK SEGMENTATION IN BANKING                        │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    INTERNET                                         │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DMZ                                              │   │
│  │  (Web servers, email, DNS)                                         │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    APPLICATION LAYER                                │   │
│  │  (Mobile app servers, API gateways)                                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DATABASE LAYER                                   │   │
│  │  (Core banking, customer data, transaction data)                    │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    INTERNAL NETWORK                                 │   │
│  │  (Internal applications, employee access)                          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

SECTION 5: CLOUD SECURITY

5.1 Cloud Security Challenges

Challenge	Description	Mitigation
Shared Responsibility	Security shared between cloud provider and customer.	Clear responsibility model.
Data Residency	Data location compliance.	Region selection, data controls.
Misconfiguration	Cloud misconfigurations.	Automated security checks.
Access Control	Managing cloud access.	IAM, MFA, least privilege.
Compliance	Meeting regulatory requirements.	Compliance tools, audits.

5.2 Cloud Security Best Practices

Practice	Description	Implementation
Identity and Access	Strong IAM in the cloud.	MFA, least privilege, role-based access.
Data Encryption	Encrypt data at rest and in transit.	AWS KMS, Azure Key Vault.
Network Security	Secure cloud networks.	VPC, security groups, WAF.
Monitoring	Continuous monitoring.	CloudTrail, Azure Monitor, SIEM integration.
Compliance	Maintain compliance.	Compliance monitoring, audits.
Incident Response	Cloud incident response.	Automated response, playbooks.

SECTION 6: IMPLEMENTATION IN PYTHON – SECURITY TOOLS

# ===================================================================
# MODULE 5, LESSON 3: SECURITY ARCHITECTURE AND ZERO TRUST
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import hashlib
import time
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("SECURITY ARCHITECTURE AND ZERO TRUST IN BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: ZERO TRUST MATURITY ASSESSMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Zero Trust Maturity Assessment")
print("-"*60)

maturity_dimensions = {
    'Identity & Access': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Device Security': {'Current Score': 3, 'Target Score': 4, 'Priority': 'High'},
    'Network Segmentation': {'Current Score': 2, 'Target Score': 5, 'Priority': 'High'},
    'Data Protection': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Visibility & Analytics': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'},
    'Automation': {'Current Score': 2, 'Target Score': 4, 'Priority': 'Medium'},
    'Policy Enforcement': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'}
}

maturity_df = pd.DataFrame(maturity_dimensions).T
print("Zero Trust Maturity Assessment:")
print(maturity_df)

# Visualise
fig, ax = plt.subplots(figsize=(10, 6))
dimensions = list(maturity_df.index)
current = maturity_df['Current Score'].tolist()
target = maturity_df['Target Score'].tolist()

x = np.arange(len(dimensions))
width = 0.35

ax.barh(x - width/2, current, width, label='Current', color='blue', alpha=0.7)
ax.barh(x + width/2, target, width, label='Target', color='green', alpha=0.7)

ax.set_yticks(x)
ax.set_yticklabels(dimensions)
ax.set_xlabel('Maturity Score (1-5)')
ax.set_title('Zero Trust Maturity Assessment')
ax.legend()
ax.grid(True, alpha=0.3, axis='x')

plt.tight_layout()
plt.savefig('zero_trust_maturity.png', dpi=300, bbox_inches='tight')
plt.show()
print("Zero trust maturity visualisation saved as 'zero_trust_maturity.png'")

# ----------------------------------------------------------------
# PART B: NETWORK SEGMENTATION SIMULATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Network Segmentation Simulation")
print("-"*60)

class NetworkSegment:
    """Simulate a network segment with security controls."""
    
    def __init__(self, name, security_level, allowed_connections=None):
        self.name = name
        self.security_level = security_level
        self.allowed_connections = allowed_connections or []
        self.devices = []
    
    def add_device(self, device_name, device_type):
        """Add a device to the segment."""
        self.devices.append({'name': device_name, 'type': device_type})
    
    def can_connect_to(self, target_segment):
        """Check if this segment can connect to another segment."""
        return target_segment.name in self.allowed_connections
    
    def get_info(self):
        """Get segment information."""
        return {
            'name': self.name,
            'security_level': self.security_level,
            'devices': len(self.devices),
            'allowed_connections': self.allowed_connections
        }

# Define network segments
dmz = NetworkSegment('DMZ', 'Medium', ['Application Layer'])
app_layer = NetworkSegment('Application Layer', 'High', ['DMZ', 'Database Layer'])
db_layer = NetworkSegment('Database Layer', 'Critical', ['Application Layer'])
internal = NetworkSegment('Internal Network', 'Medium', ['Application Layer'])
internet = NetworkSegment('Internet', 'Low', ['DMZ'])

# Add devices
dmz.add_device('Web Server', 'Server')
dmz.add_device('Email Server', 'Server')
dmz.add_device('DNS Server', 'Server')

app_layer.add_device('Mobile App Server', 'Server')
app_layer.add_device('API Gateway', 'Gateway')
app_layer.add_device('Authentication Service', 'Service')

db_layer.add_device('Customer Database', 'Database')
db_layer.add_device('Transaction Database', 'Database')
db_layer.add_device('Data Warehouse', 'Data Store')

internal.add_device('Employee PC 1', 'Workstation')
internal.add_device('Employee PC 2', 'Workstation')
internal.add_device('Printer', 'Device')

# Display network segmentation
segments = [internet, dmz, app_layer, db_layer, internal]
print("Network Segmentation:")
print(f"{'Segment':<20} {'Security Level':<15} {'Devices':<10} {'Allowed Connections'}")
print("-" * 70)
for seg in segments:
    info = seg.get_info()
    print(f"{info['name']:<20} {info['security_level']:<15} {info['devices']:<10} {', '.join(info['allowed_connections'])}")

# Check connectivity
test_cases = [
    ('DMZ', 'Database Layer'),
    ('DMZ', 'Application Layer'),
    ('Application Layer', 'Database Layer'),
    ('Internet', 'Database Layer')
]

print("\nConnectivity Checks:")
for source, target in test_cases:
    source_seg = next(s for s in segments if s.name == source)
    can_connect = source_seg.can_connect_to(next(s for s in segments if s.name == target))
    print(f"  {source} -> {target}: {'✅ Allowed' if can_connect else '❌ Blocked'}")

# ----------------------------------------------------------------
# PART C: SECURITY CONTROL ASSESSMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Security Control Assessment")
print("-"*60)

controls = pd.DataFrame({
    'Control': [
        'Firewalls',
        'IDS/IPS',
        'DDoS Protection',
        'Encryption (Data at Rest)',
        'Encryption (Data in Transit)',
        'MFA',
        'Zero Trust Network Access',
        'Network Segmentation',
        'Endpoint Protection',
        'SIEM'
    ],
    'Implemented': ['Yes', 'Yes', 'Yes', 'Yes', 'Yes', 'Yes', 'No', 'Yes', 'Yes', 'Yes'],
    'Effectiveness (1-5)': [4, 3, 4, 5, 5, 4, 2, 3, 4, 3],
    'Coverage (%)': [95, 80, 90, 85, 95, 75, 20, 70, 90, 60]
})

print("Security Control Assessment:")
print(controls.to_string(index=False))

# Visualise
fig, ax = plt.subplots(figsize=(10, 6))
bars = ax.barh(controls['Control'], controls['Effectiveness (1-5)'], 
               color='teal', alpha=0.7)
ax.set_xlabel('Effectiveness (1-5)')
ax.set_title('Security Control Effectiveness')
for bar, score in zip(bars, controls['Effectiveness (1-5)']):
    ax.text(bar.get_width() + 0.1, bar.get_y() + bar.get_height()/2, 
            str(score), ha='left', va='center')
ax.axvline(x=4, color='red', linestyle='--', label='Target (4)')
ax.legend()
ax.grid(True, alpha=0.3, axis='x')
plt.tight_layout()
plt.savefig('security_controls.png', dpi=300, bbox_inches='tight')
plt.show()
print("Security controls visualisation saved as 'security_controls.png'")

# ----------------------------------------------------------------
# PART D: SECURITY MONITORING DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Security Monitoring Dashboard")
print("-"*60)

# Simulate security monitoring data
np.random.seed(42)
n_events = 200

security_events = pd.DataFrame({
    'timestamp': [datetime.now() - timedelta(minutes=np.random.randint(0, 1440)) for _ in range(n_events)],
    'event_type': np.random.choice(['Login', 'API Call', 'Data Access', 'File Upload', 
                                   'Configuration Change', 'Admin Action'], n_events),
    'severity': np.random.choice(['Info', 'Warning', 'Error', 'Critical'], n_events, p=[0.4, 0.3, 0.2, 0.1]),
    'source': np.random.choice(['Internal', 'External', 'Cloud', 'Mobile', 'ATM'], n_events),
    'user': np.random.choice(['admin', 'user1', 'user2', 'system', 'api'], n_events),
    'status': np.random.choice(['Allowed', 'Blocked', 'Pending'], n_events, p=[0.8, 0.15, 0.05])
})

print("Security Events Sample:")
print(security_events.head())

# Summary
event_summary = security_events.groupby(['event_type', 'severity']).size().unstack(fill_value=0)
print("\nEvent Summary:")
print(event_summary)

# Visualise
fig, axes = plt.subplots(2, 2, figsize=(14, 10))

# Event Types
ax = axes[0, 0]
event_counts = security_events['event_type'].value_counts()
ax.bar(event_counts.index, event_counts.values, color='teal', alpha=0.7)
ax.set_xlabel('Event Type')
ax.set_ylabel('Count')
ax.set_title('Security Events by Type')
ax.tick_params(axis='x', rotation=45)
ax.grid(True, alpha=0.3)

# Severity Distribution
ax = axes[0, 1]
severity_counts = security_events['severity'].value_counts()
colors = {'Info': 'blue', 'Warning': 'orange', 'Error': 'red', 'Critical': 'darkred'}
ax.bar(severity_counts.index, severity_counts.values, 
       color=[colors.get(s, 'gray') for s in severity_counts.index], alpha=0.7)
ax.set_xlabel('Severity')
ax.set_ylabel('Count')
ax.set_title('Event Severity Distribution')
ax.grid(True, alpha=0.3)

# Events by Source
ax = axes[1, 0]
source_counts = security_events['source'].value_counts()
ax.pie(source_counts.values, labels=source_counts.index, autopct='%1.1f%%')
ax.set_title('Events by Source')

# Status Distribution
ax = axes[1, 1]
status_counts = security_events['status'].value_counts()
colors = {'Allowed': 'green', 'Blocked': 'red', 'Pending': 'orange'}
ax.bar(status_counts.index, status_counts.values, 
       color=[colors.get(s, 'gray') for s in status_counts.index], alpha=0.7)
ax.set_xlabel('Status')
ax.set_ylabel('Count')
ax.set_title('Event Status Distribution')
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('security_monitoring.png', dpi=300, bbox_inches='tight')
plt.show()
print("Security monitoring visualisation saved as 'security_monitoring.png'")

# ----------------------------------------------------------------
# PART E: SECURITY ARCHITECTURE METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Security Architecture Metrics")
print("-"*60)

security_metrics = pd.DataFrame({
    'Metric': [
        'Security Control Coverage',
        'Zero Trust Adoption',
        'Network Segmentation Compliance',
        'Encryption Compliance',
        'Security Incident Response Time',
        'Vulnerability Remediation Time',
        'Access Control Compliance',
        'Cloud Security Score'
    ],
    'Current Value': [
        '72%',
        '45%',
        '68%',
        '82%',
        '4.5 hours',
        '14 days',
        '78%',
        '76/100'
    ],
    'Target Value': [
        '> 95%',
        '> 80%',
        '> 95%',
        '> 99%',
        '< 1 hour',
        '< 7 days',
        '> 95%',
        '> 90/100'
    ],
    'Status': ['🟡', '🔴', '🔴', '🟡', '🔴', '🔴', '🟡', '🟡']
})

print("Security Architecture Metrics:")
print(security_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART F: SECURITY ARCHITECTURE ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Security Architecture Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Build security architecture foundation.",
        "Activities": [
            "Implement zero-trust architecture principles.",
            "Deploy network segmentation.",
            "Implement encryption at rest and in transit.",
            "Establish security monitoring and logging."
        ],
        "Success Metrics": ["Zero trust adoption > 50%", "Security control coverage > 80%"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale security architecture.",
        "Activities": [
            "Implement micro-segmentation.",
            "Deploy zero-trust network access.",
            "Implement SIEM and threat detection.",
            "Automate security controls."
        ],
        "Success Metrics": ["Zero trust adoption > 70%", "Incident response time < 2 hours"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced security capabilities.",
        "Activities": [
            "Implement AI-powered threat detection.",
            "Deploy automated response.",
            "Implement cloud-native security.",
            "Build security analytics capabilities."
        ],
        "Success Metrics": ["Zero trust adoption > 90%", "Incident response time < 1 hour"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading security architecture.",
        "Activities": [
            "Implement predictive security analytics.",
            "Build autonomous security operations.",
            "Deploy self-healing security.",
            "Achieve industry leadership."
        ],
        "Success Metrics": ["Zero trust adoption > 95%", "Industry-leading security"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Security Architecture and Zero Trust – Key Takeaways:

1. Security architecture principles: defence in depth, least privilege, zero trust.
2. Zero Trust: never trust, always verify. Key principles: verify explicitly, least privilege, assume breach.
3. Network security: firewalls, segmentation, IDS/IPS, VPN, zero-trust network access.
4. Cloud security: shared responsibility, IAM, encryption, monitoring, compliance.
5. Security monitoring: SIEM, threat detection, analytics, automated response.
6. Key metrics: control coverage, zero trust adoption, incident response time.
7. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Implement zero-trust architecture.
  - Deploy network segmentation and micro-segmentation.
  - Encrypt data at rest and in transit.
  - Implement security monitoring and SIEM.
  - Automate security controls and response.
  - Continuously assess and improve security architecture.
""")

print("="*70)
print("END OF LESSON 3 – MODULE 5")
print("="*70)

SECTION 7: SUMMARY FOR THE DATA PRACTITIONER

Security architecture is built on principles of defence in depth, least privilege, and zero trust.
Zero Trust Architecture (ZTA) assumes no user, device, or network is inherently trusted.
Key ZTA principles include verify explicitly, least privilege, assume breach, micro-segmentation, and continuous monitoring.
Network security components include firewalls, segmentation, IDS/IPS, VPN, and zero-trust network access.
Cloud security requires understanding shared responsibility, IAM, encryption, monitoring, and compliance.
Security monitoring with SIEM, threat detection, and analytics is essential for detecting and responding to threats.
Key metrics include security control coverage, zero trust adoption, incident response time, and compliance.

SECTION 8: RECOMMENDED NEXT STEPS

Implement zero-trust architecture principles.
Deploy network segmentation and micro-segmentation.
Encrypt data at rest and in transit.
Implement security monitoring and SIEM.
Automate security controls and response.
Continuously assess and improve security architecture.
Prepare for Lesson 4: Application Security and DevSecOps.

[END OF LESSON 3 – MODULE 5]

Diploma in Digital Banking Technology LESSON 3: SECURITY ARCHITECTURE AND ZERO TRUST IN BANKING

Diploma in Digital Banking Technology