Markdown Editor
Mở trình soạn thảo

Bộ mẫu kiến trúc định danh và bảo mật

Bảo mật giải pháp: IAM nội bộ và định danh khách hàng (NIST SP 800-63-4), PKI và chứng thư số, kiến trúc bảo mật, zero trust, mẫu cloud, SABSA, khả năng chống chịu mạng và mối đe dọa.

Bước 1

Định danh và tin cậy

  1. IAM Solution Design Template (NIST SP 800-63-4, SSO, PAM)

    Đầy đủ

    Identity sources, IAL/AAL/FAL, passkeys, SAML/OIDC, joiner-mover-leaver and SCIM, RBAC/SoD, PAM, access reviews, workload identity, migration

    NIST SP 800-63-4; SAML 2.0; OpenID Connect Core 1.0; RFC 9700; SCIM 2.0

  2. CIAM Solution Design Template (Passkeys, OIDC, FAPI 2.0)

    Đầy đủ

    Journeys and risk, proofing, passkeys and step-up, recovery, OAuth/FAPI profiles, consent and GDPR rights, B2B2C, fraud, scale, KPIs, migration

    NIST SP 800-63-4; OpenID Connect Core 1.0; RFC 9700; FAPI 2.0 Security Profile; WebAuthn Level 3

  3. PKI and Certificate Architecture Template (RFC 3647, 47-Day TLS)

    Đầy đủ

    Use cases, CA hierarchy and HSMs, profiles, ACME/ARI, 200/100/47-day renewal, CRL/OCSP, SPIFFE mTLS, inventory, compromise, PQC, CP/CPS map

    RFC 5280; RFC 3647; RFC 8555; CA/B Forum Baseline Requirements (Ballot SC-081v3)
Bước 2

Thiết kế

  1. Security Architecture Document Template (NIST SP 800-160, STRIDE)

    Đầy đủ

    Security architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk

    NIST SP 800-160 Vol. 1 Rev. 1 and Vol. 2 Rev. 1; NIST SP 800-63-4; STRIDE

  2. Zero Trust Architecture Plan Template (NIST SP 800-207, CISA ZTMM 2.0)

    Đầy đủ

    ZT tenets, PE/PA/PEP architecture, deployment approaches, CISA ZTMM 2.0 maturity scoring by pillar and function, target state, roadmap, metrics, risks

    NIST SP 800-207 (2020); CISA ZTMM 2.0 (2023); NIST SP 1800-35 (2025); NIST SP 800-63-4 (2025)

  3. Cloud Security Reference Patterns Template (AWS SRA, MCSB, CCM v4.1)

    Đầy đủ

    Cloud security patterns: shared responsibility, SRA accounts, identity, network, data, workload, logging, posture, provider equivalents, CCM v4.1 mapping

    AWS SRA (Jun 2026); Microsoft cloud security benchmark v2 (preview); Google enterprise foundations blueprint; CSA CCM v4.1

  4. SABSA Security Architecture Template (Business Attributes Profile)

    Đầy đủ

    Business-driven security architecture: drivers, attributes profile with metrics and targets, risk and opportunity, six layers by six questions, traceability

    SABSA (The SABSA Institute): layer and concept names only
Bước 3

Khả năng phục hồi

  1. Cyber Resiliency Design Template (NIST SP 800-160 Vol. 2 Rev. 1)

    Đầy đủ

    Cyber resiliency design: mission functions, ATT&CK adversary model, goals, objectives, 14 techniques, design principles, SP 800-53 mapping, measures

    NIST SP 800-160 Vol. 2 Rev. 1 (Dec 2021); SP 800-53 Rev. 5; MITRE ATT&CK v20

  2. Threat Model Template (STRIDE)

    Đầy đủ

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE