Security, Privacy and Regulatory Architecture

About this course

Security, privacy and regulation treated as architectural inputs, not afterthoughts. Learners threat-model systems with STRIDE and attack trees, design identity, access, secrets and key management with OAuth 2.0, OpenID Connect, passkeys and zero trust, secure the software supply chain, build GDPR-compliant data flows including residency and international transfers, and map EU obligations (NIS2, DORA, the Data Act, the Cyber Resilience Act and the European Accessibility Act) to concrete controls and the audit evidence that proves them.

For: architect, software engineer, tech leader.

Learning outcomes

On successful completion you will be able to:

1. 1Explain security architecture principles - defence in depth, least privilege, secure defaults and zero trust - and the identity, cryptography and supply-chain mechanisms that implement them.
2. 2Analyse a system with structured threat modelling (data-flow diagrams, trust boundaries, STRIDE and attack trees) and prioritise risks and controls.
3. 3Design identity, access, secrets and key-management architecture using OAuth 2.0, OpenID Connect, passkeys, workload identity and envelope encryption.
4. 4Design privacy-by-design data flows that meet GDPR principles, data-subject rights, data-residency and cross-border transfer requirements.
5. 5Evaluate an architecture against EU regulatory obligations - NIS2, DORA, the Data Act, the Cyber Resilience Act and the European Accessibility Act - and identify the controls and evidence each requires.
6. 6Take responsibility for security and compliance decisions - accept, mitigate or escalate risk - and produce audit evidence that would satisfy a regulator or an external auditor.

Modules and lessons

1. Week 1Principles and threat modelling⌄

   • Security architecture principles
   • Threat modelling with STRIDE and attack treeslab
2. Week 2Identity and access⌄

   • Identity: OAuth 2.0, OpenID Connect and passkeys
   • Authorisation models and zero trust
3. Week 3Protecting data and the supply chain⌄

   • Secrets, keys and encryption
   • Software supply-chain securitycase study
4. Week 4Privacy by design⌄

   • Privacy by design and GDPR for architects
   • Data residency, sovereignty and cross-border transferscase study
5. Week 5EU regulation as an architectural input⌄

   • NIS2, DORA and operational resilience
   • The Data Act, the Cyber Resilience Act and accessibility
6. Week 6Assurance and accountability⌄

   • Compliance frameworks, controls and audit evidencecase study
   • Security incidents, risk acceptance and the architect's accountability

Assessment

• Quiz (15%)

  Six weekly quizzes drawn from the lesson quiz banks; best five count.

• Lab (20%)

  Threat-modelling lab - data-flow diagram, STRIDE analysis and a prioritised control plan for a provided multi-tenant SaaS system.

• Design review (30%)

  Security and privacy architecture for a provided case - identity and access design, key and secrets management, and GDPR-compliant data flows including transfers.

• Case analysis (15%)

  Written analysis of a published breach or regulatory decision, mapping failures to missing controls and to the EU obligations that would apply today.

• Viva (20%)

  Twenty-minute defence of the design before mentors acting as CISO and DPO, including a risk-acceptance decision posed by the panel.

Pass mark 60%. Grades: Distinction, Merit, Pass.