Belajar Security Architect - Application & Data Security Architecture

#Pendahuluan

Setelah di episode 7 kita mempelajari cloud security architecture, pada episode ini kita dalami application & data security architecture — bagaimana mendesain aplikasi dan melindungi data dari design phase. Application security bukan sekadar testing — ia harus built-in dari awal.

Mengapa app & data security penting? Karena data adalah asset paling berharga organisasi, dan aplikasi adalah gerbang ke data itu. Arsitektur aplikasi yang tidak aman akan mengubur vulnerability yang sulit diperbaiki nanti.

#Secure Application Design Patterns

#Pattern 1: Defense in Depth

100%

#Pattern 2: Secure by Default

Principle	Implementasi
Deny by default	Explicit allow only
Least privilege	Minimal permissions
Fail secure	Deny on error
Complete mediation	Check every access

#Pattern 3: Separation of Duties

Function	Different Person/System
Code development	Developer
Code review	Peer reviewer
Deployment	CI/CD pipeline
Approval	Release manager

Note

Defense in depth bukan berarti lebih banyak layers = lebih aman. Each layer harus memberikan security value yang berbeda. Duplikasi layer yang sama hanya menambah complexity tanpa security benefit.

#Data Protection Strategy

#Data Classification

Level	Kategori	Contoh	Kontrol
Public	Published data	Marketing content	Integrity
Internal	Employee data	Email, docs	Access control
Confidential	Sensitive data	Financial, PII	Encryption + audit
Restricted	Critical data	Credentials, keys	HSM + MFA

#Data Lifecycle Security

Tahap	Security
Creation	Classification at source
Storage	Encryption at rest
Processing	Encryption in transit
Sharing	Access controls + DLP
Archival	Retention policies
Destruction	Crypto-shredding

#Encryption Architecture

#Encryption Layers

Layer	Method	When
At rest	AES-256, cloud KMS	Storage
In transit	TLS 1.3	Network
In use	Confidential computing	Processing
Application	End-to-end	Specific data

#Key Management

Approach	Best For
Cloud KMS	Cloud-native
HSM	High-security
BYOK	Customer control
HYOK	Maximum isolation

100%

Tip

Encryption without proper key management is theater. Invest in KMS/HSM and automated key rotation. Never store keys alongside encrypted data.

#OWASP ASVS

OWASP Application Security Verification Standard memberikan checklist keamanan aplikasi:

Level	Scope
Level 1	Basic security controls
Level 2	Standard security controls
Level 3	Advanced security controls

#Penutup

Inti yang harus dibawa pulang:

Secure design: built-in dari awal, bukan added on.
Defense in depth: multiple meaningful layers.
Data classification determines protection level.
Encryption: at rest, in transit, in use.
Key management is as important as encryption itself.

Di episode 9 selanjutnya kita akan membahas security reference architectures — build reference architectures, security patterns, dan standards yang bisa direuse.