Design Security for Real Human Systems
Build security that survives deception, pressure, support, recovery, insider authority, poor incentives, and daily work.
Topic index
Security Operations and Risk
Learn the threats, controls, and operating practices that reduce access risk.
Topic index
Understand this domain
Pomerium coverage
Pomerium records authorization decisions for protected routes. Operators can send logs to an owned analysis and retention path and can add selected MCP fields. The surrounding applications, endpoints, identity provider, and network still need their own event sources.
Limits
- An authorization log is not a complete application, endpoint, or network audit trail.
- More logging can expose sensitive data when fields are not selected and protected carefully.
- A gateway can limit an access path, but it does not isolate an unsafe tool or application runtime.
Primary sources
2 learning paths
Paths for this topic
Operate and recover access systems
Govern, observe, detect, investigate, preserve evidence, contain, recover, and assure an identity-aware access system.
33 related guides
Guides in this topic
Analyze Security Incentives
Map cost, benefit, authority, information, liability, and feedback so a control works after teams and vendors optimize their own goals.
Assess risk in an access path
Connect assets, threats, likelihood, impact, controls, evidence, assumptions, and residual risk for one access system.
Audit and revoke agent actions
Trace one agent action through identity, delegation, policy, approval, credential, tool, target, result, and future revocation.
Build a Security Behavior Learning Program
Turn role-specific risks into practiced tasks, usable tools, behavior measures, feedback, and control improvements.
Build an access audit trail
Join authentication, authorization, proxy, and application evidence without confusing one event for another.
Build assurance for an access control
Connect a protection need to requirements, design, implementation, tests, operations, evidence, and residual risk.
Build detections for access systems
Design and validate signals for route bypass, credential abuse, stale authority, policy drift, and control failure.
Commission and Retire an Access System
Put an access system into service and remove it with verified ownership, authority, dependencies, evidence, and final state.
Contain compromised access
Disable identity, revoke credentials and sessions, isolate routes, and measure the last accepted harmful action.
Design access control during failure
Define fail-closed, fail-open, degraded, cached, and break-glass states for every access dependency before an outage.
Design access controls that people can use
Use open design, clear choices, safe defaults, and observable recovery so people can operate security correctly.
Design access for resilience and recovery
Keep access controls safe through dependency failures, limit damage, recover service, and prove the restored state.
Design Privacy-Preserving Security Telemetry
Collect enough access evidence for detection and investigation while limiting identity detail, linkability, sensitive content, recipients, and retention.
Govern the access policy lifecycle
Assign owners and review, approve, deploy, observe, expire, and retire access policy with evidence and rollback.
Harden a Security-Sensitive Service
Build, deploy, verify, update, and recover a role-specific minimal service without broad host or control-plane authority.
Manage access-system vulnerabilities and patches
Prioritize exposure and authority, deploy verified patches, watch behavior, and retain a safe rollback path.
Manage application vulnerabilities
Receive, reproduce, triage, remediate, verify, disclose, deploy, and learn from application vulnerability reports.
Operate access configuration as code
Review, test, deploy, attest, observe, and reconcile access configuration without allowing hidden runtime drift.
Operate Actionable Threat Intelligence
Convert evaluated threat information into owned prevention, detection, hunting, patching, response, and risk decisions.
Operate protocol versions and deprecations
Inventory protocol profiles, detect use, migrate consumers, and remove obsolete versions without permanent compatibility paths.
Operate temporary and break-glass access
Grant short-lived and emergency authority with explicit scope, expiry, approval, monitoring, revocation, and review.
Operate the authorization policy lifecycle
Move access policy from protection need through review, testing, staged deployment, observation, rollback, and retirement.
Operate the credential and key lifecycle
Generate, store, issue, distribute, rotate, revoke, destroy, and recover credentials and cryptographic keys.
Operate token status and revocation
Separate token expiry, introspection, revocation, session termination, and replay response and measure the effective denial time.
Preserve Digital Evidence During an Incident
Collect and preserve access evidence with documented integrity, context, custody, privacy, and reproducibility.
Protect the access software supply chain
Verify source, dependencies, builds, provenance, artifacts, deployment, and runtime identity for access components.
Protect the data lifecycle
Control collection, use, sharing, storage, logging, backup, recovery, retention, deletion, and sanitization for one data class.
Recover an access system
Restore known-good identity, policy, trust, routes, evidence, and service after compromise or control failure.
Replace stored secrets with workload credentials
Separate stored secrets from projected, rotated credentials and reduce exposure through identity-bound delivery and use.
Respond to an identity and access incident
Prepare, investigate, contain, recover, and learn when identity or access authority is abused or compromised.
Test Backup, Restore, and Clean Rebuild
Prove that access systems can meet recovery objectives without restoring compromised authority, code, policy, or data.
Test common authentication attacks
Distinguish and test guessing, stuffing, spraying, phishing, MFA fatigue, recovery abuse, and session theft.
Triage and Investigate Security Alerts
Turn an access alert into a supported finding, a bounded response decision, and useful feedback for the detection.
62 related terms
Concepts in this topic
Access System Inventory
Inventory protected resources, identities, routes, policies, credentials, dependencies, owners, and recovery paths.
Adversary Model
State who can attack the system, what they want, what they can do, where they start, and what constrains them.
Agent and Tool Inventory
Inventory agent identities, hosts, models, tools, servers, credentials, owners, versions, targets, and provenance.
Agent Blast Radius
Agent blast radius is the maximum credible effect that an agent can cause through its tools, credentials, data access, network reach, and chained actions.
Agent Cascading Failure
Stop one false result, repeated action, or unavailable dependency from propagating through agents and tools with growing impact.
Agent Credential Custody
Keep agent credentials isolated by user, task, audience, and tool and control storage, use, rotation, and revocation.
Agentic Supply Chain
Verify the origin, version, integrity, permissions, and change process for agent code, models, prompts, tools, and metadata.
Attack Surface
An attack surface is the set of boundary points where an attacker can try to enter a system, cause an effect, or extract data.
Attack Tree
An attack tree decomposes one attacker goal into alternate and combined paths that can achieve it.
Authorization Decision Log
Record enough structured evidence to explain and test an access decision without storing credentials or excess personal data.
Authorization Drift
Authorization drift is the gap that develops when effective access no longer matches intended access.
Backup and Restore
Create isolated, complete, recoverable copies and prove they restore current service without old compromise, authority, or expired data.
Certificate Lifecycle
Issue, deploy, rotate, revoke, recover, and retire certificates and private keys without breaking name or trust validation.
Cloud Access Security Broker (CASB)
A Cloud Access Security Broker is a policy enforcement point that mediates use of cloud services.
Cyber Threat Intelligence
Turn evaluated information about adversaries, behavior, infrastructure, vulnerabilities, and incidents into a time-bounded security decision.
Data Breach
A data breach is the loss of control, compromise, unauthorized disclosure, acquisition, or access to sensitive information.
Defense in Depth
Place complementary controls across distinct failure domains so one failure does not expose the protected asset.
Denial of Service
Model how traffic, expensive valid work, state, queues, dependencies, identity, and recovery controls can make a service unavailable.
Detection Quality
Evaluate whether a detection observes the intended behavior with useful fidelity, timeliness, coverage, context, response, and manageable error.
Digital Forensics for Incident Response
Identify, collect, preserve, examine, analyze, and report digital evidence with stated scope, methods, time, integrity, and uncertainty.
Distributed Security State
Control policy, identity, revocation, key, context, and quota state across replicas with explicit freshness and failure semantics.
Encryption
Encryption transforms plaintext into ciphertext under a cryptographic key. Symmetric encryption uses a shared secret key.
Endpoint Security
Endpoint security is the set of controls used to manage and protect devices that access organizational data and services.
Evidence Integrity and Chain of Custody
Show that evidence is authentic enough for its purpose and record every collection, transfer, access, transformation, analysis, and disposition.
Hidden Trust Boundary
A hidden trust boundary exists when one component accepts another component's identity, authority, data, or result without an explicit enforced rule.
Identity-Aware Rate Limiting
Identity-aware rate limiting bounds request volume by accountable subject, client, resource, action, and cost.
Indicator of Compromise and TTP
Distinguish short-lived technical observables from adversary tactics, techniques, and procedures used to build more durable detection and response.
Insider Threat
Reduce harmful action by people or partners who hold legitimate access, knowledge, proximity, or influence, whether intentional or accidental.
Intrusion Detection
An intrusion detection system monitors events and produces alerts when it finds signs of an incident or policy violation.
Joiner, Mover, and Leaver Lifecycle
Create, change, and remove identity and access state when a person or workload enters, changes, or leaves a role.
Lateral Movement
Lateral movement is the post-compromise use of techniques to enter and control additional remote systems or accounts in an environment.
Malware
Understand malicious code that steals, persists, disrupts, spies, moves, or changes systems and prepare to contain and rebuild affected trust.
Man-in-the-middle attack (MITM)
A man-in-the-middle attack places an adversary between two parties to intercept, relay, or change communication without their knowledge.
MCP Security
Model Context Protocol security is the set of controls that protects hosts, clients, servers, tools, authorization flows, and downstream resources.
MITRE ATT&CK
MITRE ATT&CK catalogs observed adversary tactics and techniques that can guide hypotheses, detections, and investigations.
OWASP (Open Worldwide Application Security Project)
OWASP is the Open Worldwide Application Security Project.
Principle of Least Privilege
Limit authority by resource, action, context, and time, then remove access when the assigned function ends.
Prompt Injection
Learn how direct and indirect prompt injection can drive unsafe agent actions, and how least privilege and authorization reduce impact.
Ransomware
Ransomware is malware used to deny access to data or systems and demand payment. Many operators also steal data and threaten disclosure.
Recovery Time and Recovery Point Objectives
Set and test the maximum target time to restore a service and maximum acceptable data loss after disruption.
Revocation Latency
Measure how long a disabled identity, authenticator, session, claim, or permission can continue to authorize action.
Secure Enclave
Secure enclave is a general phrase for an isolated execution area, but it is also used in product names such as Apple's Secure Enclave.
Secure System Decommissioning
Remove a system, route, identity, key, dependency, and data without leaving reachable shadow service or breaking another security control.
Secure Web Gateway (SWG)
An SWG applies policy to user access to internet web services.
Security Alert Triage
Qualify, categorize, prioritize, enrich, assign, and escalate a potential incident from evidence, asset criticality, identity, scope, and impact.
Security and Compliance
Security protects stated assets and properties, while compliance evaluates obligations against defined criteria and evidence.
Security Assurance and Evidence
Distinguish a control claim, verification, validation, assurance argument, and the evidence that supports each conclusion.
Security Awareness and Behavior Change
Build role-specific learning around real tasks, safe alternatives, practice, feedback, and measured behavior instead of annual completion.
Security Culture for Access Systems
Security culture makes ownership, review, reporting, response, and recovery normal parts of access-system work.
Security Information and Event Management (SIEM)
Security information and event management collects, normalizes, stores, searches, and correlates security-relevant event and log data from multiple sources.
Security Postmortem
A security postmortem turns an incident timeline, contributing conditions, and response evidence into owned system changes.
Security Risk
Connect a credible threat, likelihood, consequence, uncertainty, and stakeholder impact to an explicit risk decision.
Security Telemetry
Security telemetry uses logs, metrics, traces, and events to answer defined detection, investigation, and control questions.
Security Understandability
Make the system, its authority, dependencies, state, failure behavior, and evidence clear enough to change and operate safely.
Sensitive Security Logging
Record useful access evidence while preventing credentials, excess personal data, tampering, and indefinite retention.
Shared Responsibility for Access
Shared responsibility assigns each access control, dependency, decision, evidence source, and recovery action to an owner.
Software Supply Chain Evidence
Distinguish component inventory, build provenance, attestations, signatures, and the policy that verifies them.
System Hardening
Reduce a deployed system to required services, identities, interfaces, privileges, configurations, and recovery paths, then keep it there.
Threat Hunting
Proactively test a bounded threat hypothesis in existing evidence when no alert has yet confirmed the activity.
Threat, Vulnerability, and Attack
Distinguish a possible harmful event, a weakness, an attempted exploit, exposure, consequence, and impact.
Tool Surface Area
Tool surface area is the full set of operations, inputs, external resources, and privilege effects that tools make available to an agent.
Trusted Execution Environment (TEE)
A TEE is an execution environment isolated from software outside the TEE. It protects selected code and data against a defined set of threats.
