Security to be expressed so Execs and Techs can Understand
| Component / Layer | Non-Technical Description 📘 | Technical Description ⚙️ | Example 🎯 | Glossary 🔍 |
|---|---|---|---|---|
| 🌐🛡️ DNS & DDoS Protection | Stops attackers from taking down your site and makes sure users find the right server. | AWS Route 53 / Azure DNS for domain resolution. AWS Shield Advanced / Azure DDoS Protection for volumetric and protocol-level DDoS defence. | Customer connects to myapp.example.com which resolves via Route 53; large botnet attack is absorbed by Shield/Azure DDoS before reaching your app. | DDoS – Distributed Denial of Service. DNS – Domain Name System. |
| 🚧 Web Application Firewall (WAF) | Blocks dodgy requests before they reach your application. | AWS WAF / Azure WAF filters HTTP(S) traffic using OWASP CRS, geo/IP restrictions, and bot mitigation. | SQL injection attempt blocked at WAF before it hits API Gateway. | WAF – Firewall for web traffic. OWASP CRS – Common attack ruleset. |
| 🛎️ API Gateway / Reverse Proxy | Acts as a doorman for your app, checking tickets and routing requests. | Amazon API Gateway / Azure API Management with HTTPS (TLS 1.2+), optional mTLS, JWT validation, rate limiting. | API Gateway verifies JWT from Entra ID, allows only authenticated traffic to app services. | API Gateway – API routing/security. mTLS – Mutual TLS. JWT – JSON Web Token. |
| 🔑 Identity & Access Management | Controls who gets in and what they can do. | Amazon Cognito / IAM Identity Center; Microsoft Entra ID; OIDC/OAuth2/SAML; Conditional Access + MFA. | Contractor logs in with MFA, gets temporary role to run reports. | OIDC/OAuth2 – Authentication/authorisation standards. MFA – Multi-Factor Authentication. |
| 🖥️ Application Tier (Private) | The “middle floor” between the internet and the database – no public access. | AWS: ALB, ECS/EKS/Lambda in private subnets, SG rules; Azure: App Gateway (private), AKS/App Service in private subnet, NSGs. | App containers in EKS talk to DB via PrivateLink; no direct internet. | ALB – Application Load Balancer. NSG – Network Security Group. |
| 🔒 Private Connectivity to DB | A private tunnel to your database – invisible from the internet. | AWS: VPC Endpoints (PrivateLink) to RDS/Aurora; Azure: Private Endpoints to SQL/MI/Cosmos DB; no public IP exposure. | App queries DB over TLS via Private Endpoint; no route from internet. | PrivateLink/Private Endpoint – Private IP access to services. |
| 🗝️ Secrets & Key Management | Stores keys/passwords safely and hands them out only to trusted apps. | AWS Secrets Manager + KMS; Azure Key Vault + Managed HSM; scoped RBAC. | App retrieves DB creds from Secrets Manager just before connecting. | KMS – Key Management Service. HSM – Hardware Security Module. |
| 🗄️ Database (Private) | The data store itself, locked away behind layers of security. | AWS RDS/Aurora/Redshift; Azure SQL DB/Managed Instance; encryption at rest (TDE), TLS in transit, private endpoints, DB-level RBAC. | Azure SQL DB allows only app_role via Managed Identity. | TDE – Transparent Data Encryption. RBAC – Role-Based Access Control. |
| 🧑💻 Admin Access (JIT) | Short-term, controlled access for maintenance – no permanent keys. | AWS SSM Session Manager / Azure Bastion with PIM; zero inbound SSH/RDP; session recording; elevated DB roles time-boxed. | DBA elevates via PIM for 1 hour, connects through Bastion, changes schema, role revoked automatically. | PIM – Privileged Identity Management. JIT – Just-In-Time access. |
| 🛡️ Firewalls (Cloud) | Guard posts that only allow approved traffic through. | AWS Network Firewall; Azure Firewall; deny-by-default, allow only specific ports/IPs/FQDNs; layer 4/7 filtering. | Azure Firewall only allows outbound 443 to Key Vault, DB Private Endpoint, update servers. | Layer 4/7 – OSI model layers. |
| 📊 Monitoring & SIEM | Keeps watch and raises the alarm if something odd happens. | AWS CloudWatch/CloudTrail/GuardDuty; Azure Monitor/Defender; logs sent to Microsoft Sentinel or Splunk; automated runbooks for response. | Sentinel detects multiple failed DB logins, triggers Lambda runbook to disable account. | SIEM – Security Information & Event Management. Runbook – Automated procedure. |
| 🔏 Protocol & Cipher Hygiene | Makes sure all traffic is encrypted with modern standards. | TLS 1.2/1.3 enforced; mTLS for service-to-service; DB SSL mode verify identity; SSH Ed25519 keys if unavoidable. | API Gateway enforces TLS 1.3, blocks weak ciphers. | Cipher suite – Set of algorithms for encrypting traffic. |
