Belajar Security Architect - Compliance & Regulatory Architecture

#Pendahuluan

Setelah di episode 9 kita mempelajari security reference architectures, pada episode ini kita dalami compliance & regulatory architecture — bagaimana memetakan requirement regulatory ke arsitektur. Compliance bukan checkbox — ia harus built-in dari design phase.

Mengapa compliance architecture penting? Karena retrofit compliance ke arsitektur yang sudah ada jauh lebih mahal dan riskier daripada built-in dari awal. Security architect harus memahami regulatory landscape dan menerjemahkannya ke design decisions.

#Regulatory Frameworks

Requirement	Architecture Response
Data minimization	Collect only needed data
Right to erasure	Crypto-shredding, delete workflow
Data portability	Standard export formats
Breach notification	Automated detection + reporting
Privacy by design	Default privacy controls

#PCI DSS

Requirement	Architecture Response
Network segmentation	Cardholder data environment isolation
Encryption	AES-256 at rest, TLS in transit
Access control	Least privilege, MFA
Logging	Audit trails, SIEM
Vulnerability mgmt	Regular scanning, patching

#SOC 2

Criteria	Architecture Response
Security	Access controls, monitoring
Availability	Redundancy, disaster recovery
Processing Integrity	Validation, error handling
Confidentiality	Encryption, DLP
Privacy	Data protection controls

#ISO 27001

Control	Architecture Response
A.5 Information security policies	Documented standards
A.8 Asset management	Asset inventory, classification
A.9 Access control	IAM, RBAC/ABAC
A.12 Operations security	Monitoring, logging
A.14 System acquisition	Secure SDLC

#Compliance-as-Code

#Implementasi

Contoh: OPA policy untuk compliance

package main
 
deny[msg] {
  input.resource.aws_s3_bucket.server_side_encryption_configuration == null
  msg := "S3 bucket harus memiliki encryption enabled"
}
 
deny[msg] {
  input.resource.aws_s3_bucket.acl == "public-read"
  msg := "S3 bucket tidak boleh public"
}

#Tools

Tool	Fungsi
OPA (Open Policy Agent)	Policy engine
Sentinel	HashiCorp policy
AWS Config Rules	Cloud compliance
Azure Policy	Azure compliance

100%

Tip

Compliance-as-code mengubah compliance dari aktivitas manual tahunan menjadi aktivitas otomatis kontinu. Investasikan waktu untuk membangun policies sekali, lalu jalankan otomatis di setiap deployment.

#Mapping Control ke Arsitektur

Control Framework	Architecture Mapping
Encryption	KMS, TLS config
Access control	IAM, RBAC
Logging	SIEM, audit trails
Network security	Segmentation, firewall
Vulnerability mgmt	Scanning, patching

Note

Compliance mapping harus dilakukan di awal design, bukan saat audit. Security architect harus bisa menunjukkan bagaimana setiap control dipenuhi oleh arsitektur yang dirancang.

#Penutup

Inti yang harus dibawa pulang:

GDPR, PCI, SOC2, ISO 27001: masing-masing punya requirements unik.
Compliance harus built-in dari design, bukan retrofit.
Compliance-as-code: OPA, Sentinel, cloud-native policy tools.
Mapping control ke arsitektur harus terdokumentasi.

Di episode 11 selanjutnya kita akan membahas secure SDLC & DevSecOps architecture — security dalam development lifecycle, CI/CD security, dan architecture reviews.