The different layers of security architecture we've covered in this series all do their work in the moment. They notice behaviors and actions and can block, isolate, or deny them based on the rules, policies, and permissions designed for those layers.

But what happens when historical actions need to be referenced, perhaps for incident investigation or digital forensics? That's where logging fits into security architecture. It makes it possible to store and review the activity generated by the other layers — endpoint, application and API , data, network, and identity.

Logging is the layer that helps investigations identify entry points and trace the path an attacker took. It's also how a team determines what data was accessed and the scope of an incident.

Monitoring, Logging, and Detection

Valleywind’s Security Information and Event Management (SIEM) pulls logs from the identity system, VPN, Endpoint Detection and Response (EDR), firewalls, APIs, and databases. This is one of the most critical architectural layers because logs reconstruct what happened during an attack.

If an attacker were to gain access to any part of the environment and there are no logs to guide the security team and tell the story, they are essentially going in blind, attempting to recreate events about which they lack information. You can’t see the entry point, the path taken, the data accessed, or the systems affected.

If an attacker compromises one of Valleywind's keys for the GCP service account, like the scenario mentioned in Layered Security Architecture: Identity and the Network, here's how the logs would help in painting a picture of the incident for the SOC team.

  • Identity logs would show the service account logging in from an unusual location
  • Network logs would record attempts to create new firewall rules
  • API and application logs would reflect repeated failed admin calls from that service account
  • EDR logs would report on workstation anomalies

The SOC's role would be to piece it all together and take action before any damage occurs.

Security architecture done right ensures every security component in place contributes relevant logging evidence about an incident, creating a clear timeline of events that supports investigations.

Let's Put It All Together

Now that you've seen how the logging layer furthers the agenda of securing the enterprise through its architectural decisions, it is easier to imagine how all the layers come together to realize an organization's mission and strategic objectives. Here's where each part of this series fits:

  • Identity and the Network: who gets into the environment, and how far they can move inside it
  • Endpoint, Application, and Data: where attacks land, and what an attacker reaches for once inside
  • Logging, Monitoring, and Detection: how the events across those layers get reconstructed after the fact

Let's go through a single attack in which every layer plays its part and contributes to the security architecture as a whole.

An employee in Valleywind Health's Billing department receives a phishing email from an attacker posing as an insurance representative following up on an overdue claim. The employee, out of concern, hastily opens the attachment, causing the malware to run.

The upside in this scenario is that the attacker cannot access patient data since the identity layer restricts this employee's access to billing systems and there is no privilege escalation path to explore.

Before we continue, remember that the employee's machine is confined within the Billing department's network segment, so this alone prevents any communication with clinical servers, which is likely the attacker's target.

The malware is now on the employee's computer, and they have no clue. It begins scanning the subnet and rapidly encrypting files. The EDR agent kills the process, isolates the device, and sends high-severity alerts to the SOC so they can step in before the threat spreads.

With a compromised Billing account, the attacker turns to the patient portal. The secure API design ensures that every request is checked against the identity making it. The result is that access is denied, because a Billing account lacks the permissions needed to access patient data.

The DLP policy will either block or set off alerts for large outbound file transfers to prevent the attacker from exporting bulk PHI.

Once the suspicious activity has been correctly detected, the alerts will go to the SOC with a clear timeline of events about:

  • What happened after the malicious attachment was opened
  • Actions taken by the EDR including isolation
  • A series of denied identity events
  • Bulk data transfers blocked

Because Valleywind's visibility is strong, the SOC, fully understanding what occurred, remediates quickly, and reports the incident with confidence.

Security architecture is the security processes and technical controls that are designed to secure all components that make up an organization and contribute to its mission and strategic objectives. When you walk through an environment layer by layer, the architecture becomes tangible, and you realize that while each component plays a role, it’s their connection and interaction that make the organization resilient.