Learn English with Cybersecurity

Security Architecture Principles 🔐

Aprende vocabulario técnico y gramática en inglés mientras estudias principios esenciales para diseñar sistemas seguros, resilientes y confiables.

Nivel recomendado B1–B2

Tema Cybersecurity Architecture

Habilidades Technical English, grammar y vocabulary

🛡️ Introduction

Security architecture principles help organisations design systems that reduce risk, protect sensitive information and limit the impact of security incidents.

These principles should be applied during the design, development, deployment and operation of applications, infrastructure and services. They are especially important in cloud environments, financial systems, critical infrastructure and regulated industries.

Good security architecture does not depend on a single control. It combines identity management, access control, segmentation, monitoring, secure configuration and continuous verification.

🔑 1. Assign the Least Privilege Possible

Why?

Broad privileges can allow malicious or accidental access to protected resources. Excessive permissions increase the impact of compromised accounts, vulnerable applications and human error.

How?

• Give users and services only the minimum access required to complete an assigned task.
• Grant access only for the minimum period of time necessary.
• Avoid using administrative accounts for normal application access.
• Use separate accounts for administrative tasks and sensitive data.
• Review privileges regularly and remove permissions that are no longer required.
• Use temporary or just-in-time access for high-risk operations.

Examples

• Run each service process under its own dedicated account.
• Grant read-only access when users do not need to modify data.
• When updates are required, limit permission to the specific target resource.
• Allow developers to deploy only to the environments for which they are responsible.

🧩 2. Separate Responsibilities

Why?

Separating responsibilities reduces the risk that one person, account or component can perform every sensitive action. It also limits the blast radius of a successful attack.

If one part of a system is compromised, proper separation can prevent the attacker from gaining control of the entire environment.

How?

• Separate development, testing and production environments.
• Separate administrative accounts from standard user accounts.
• Require approval from another person for high-risk operations.
• Separate security monitoring from system administration.
• Divide critical processes into independent security zones.
• Prevent a single account from initiating and approving the same transaction.

Example

A developer may create application code, but a separate authorised person or automated pipeline should approve and deploy it to production.

👁️ 3. Trust Cautiously

Why?

Many security incidents are caused by compromised identities, untrusted devices, malicious intermediaries or unauthorised components in a communication path.

Trust should not be granted automatically because a user or device is located inside the corporate network.

How?

• Assume unknown entities are untrusted.
• Establish a clear process for granting trust.
• Verify who or what is connecting.
• Use strong authentication for users and services.
• Validate device health and security posture.
• Apply network controls and segmentation.
• Encrypt sensitive communications.
• Avoid dynamically loading unverified third-party code.
• Continuously reassess trust during a session.

Important: Authentication alone is not enough. Systems should also verify authorisation, device condition, location, risk level and the sensitivity of the requested resource.

🧱 4. Use Defence in Depth

Why?

No security control is perfect. A single control may fail because of misconfiguration, human error, software vulnerability or an advanced attack.

How?

• Use multiple independent layers of security.
• Combine preventive, detective and corrective controls.
• Apply controls at identity, endpoint, network and application levels.
• Use logging and monitoring to detect suspicious behaviour.
• Prepare incident response and recovery procedures.

Example

A sensitive application may use multifactor authentication, role-based access control, encryption, network segmentation, activity monitoring and backup recovery controls.

🔒 5. Secure by Default

Why?

Default configurations are often used without modification. If a system is insecure by default, it may remain exposed for a long time.

How?

• Disable unnecessary services and features.
• Deny access unless it is explicitly permitted.
• Require secure authentication from the beginning.
• Use encryption by default for sensitive information.
• Apply secure baseline configurations.
• Remove or change default passwords.

A new storage service should be private by default. Public access should require an explicit, documented and approved configuration change.

🧠 Grammar Focus

1. Imperatives

En documentación técnica se utilizan mucho los imperatives para expresar instrucciones, recomendaciones y controles.

Base verb + complement

Assign the least privilege possible.
Use separate accounts.
Validate every connection.
Disable unnecessary services.

El sujeto you está implícito:

Use strong authentication.
Utiliza autenticación robusta.

2. Negative imperatives

Para expresar una prohibición o una recomendación negativa usamos do not seguido del verbo base.

Do not + base verb

Do not use administrative accounts for normal tasks.
No utilices cuentas administrativas para tareas normales.

Do not grant broader access than necessary.
No concedas permisos más amplios de lo necesario.

3. Modal verb: should

Should se utiliza para dar recomendaciones o indicar buenas prácticas.

Subject + should + base verb

Organisations should review privileges regularly.
Las organizaciones deberían revisar los privilegios periódicamente.

Systems should not trust unknown entities automatically.

4. Must and have to

Must y have to expresan obligación.

Subject + must + base verb

Administrators must protect privileged accounts.
Los administradores deben proteger las cuentas privilegiadas.

Users have to authenticate before accessing sensitive resources.

En políticas y normas, must suele expresar una obligación más estricta.

5. Passive voice

La voz pasiva es frecuente en documentación técnica porque permite destacar el control, el recurso o la acción.

subject + be + past participle

Access must be granted only when necessary.
El acceso debe concederse únicamente cuando sea necesario.

All connections should be authenticated.
Sensitive data must be encrypted.

6. Only + noun phrase

Only sirve para limitar una acción, permiso o condición.

Grant only the minimum access required.
Concede únicamente el acceso mínimo requerido.

Allow access only to authorised users.

7. When and if

When se utiliza para situaciones esperadas. If se utiliza para condiciones posibles.

When updates are required, limit access to the target resource.

If an account is compromised, revoke its permissions immediately.

8. Purpose with “to”

El infinitivo con to puede expresar propósito.

Use segmentation to limit the blast radius.
Utiliza segmentación para limitar el radio de impacto.

Use monitoring to detect suspicious behaviour.

9. Relative clauses

Las oraciones relativas permiten añadir información sobre usuarios, sistemas o recursos.

who → personas
that / which → cosas y sistemas

Users who manage sensitive systems should use multifactor authentication.

Services that process confidential information must be monitored.

10. Gerunds after prepositions

Después de una preposición utilizamos normalmente un verbo terminado en -ing.

Reduce risk by limiting access.
Prevent attacks by validating identities.
Improve security without disrupting operations.

11. Comparatives

Los comparativos permiten explicar cómo una medida mejora o empeora el nivel de seguridad.

Temporary access is safer than permanent access.
Strong authentication is more secure than password-only authentication.

📚 Key Vocabulary

English	Español	Example
least privilege	mínimo privilegio	Least privilege reduces unnecessary access.
access rights	derechos de acceso	Access rights should be reviewed regularly.
privileged account	cuenta privilegiada	A privileged account requires stronger protection.
blast radius	radio de impacto	Segmentation can reduce the blast radius of an attack.
to compromise	comprometer	The attacker compromised an administrator account.
to grant	conceder	The system granted temporary access.
to revoke	revocar	Revoke access when it is no longer required.
authentication	autenticación	Authentication verifies identity.
authorisation	autorización	Authorisation determines what a user can do.
segmentation	segmentación	Network segmentation limits lateral movement.
security posture	postura de seguridad	The system checks the device security posture.
defence in depth	defensa en profundidad	Defence in depth uses multiple security layers.
secure by default	seguro por defecto	New resources should be secure by default.
sensitive resource	recurso sensible	Only authorised users may access sensitive resources.
third-party code	código de terceros	Third-party code should be validated before use.

💬 Useful Technical Expressions

To grant access

Grant access only after verifying the user’s identity.
Concede acceso únicamente después de verificar la identidad del usuario.

To revoke permissions

Revoke permissions when an employee changes roles.
Revoca los permisos cuando un empleado cambia de función.

To limit the blast radius

Network segmentation helps limit the blast radius of a compromise.
La segmentación de red ayuda a limitar el impacto de un compromiso.

To establish trust

The system must establish trust before allowing access.
El sistema debe establecer confianza antes de permitir el acceso.

To apply security controls

Apply security controls according to the sensitivity of the resource.
Aplica controles de seguridad según la sensibilidad del recurso.

🔎 Reading Comprehension

1. Why are broad privileges dangerous?
2. What does least privilege mean?
3. Why should administrative accounts be separated?
4. How does separation of responsibilities reduce risk?
5. Why should unknown entities be considered untrusted?
6. What is defence in depth?
7. What does secure by default mean?

Ver las respuestas

1. Because they can allow malicious or accidental access to protected resources.
2. It means granting only the minimum access necessary to perform a task.
3. To reduce the risk of privileged access being used during normal activities.
4. It prevents one person or component from controlling every sensitive action.
5. Because their identity, device or behaviour has not yet been verified.
6. It is the use of multiple independent layers of security.
7. It means that the initial configuration should already be secure.

✏️ Grammar Practice

Completa las oraciones con la forma correcta de las palabras entre paréntesis.

1. Administrators should permissions regularly. (review)
2. Sensitive data must . (encrypt)
3. Do not administrative accounts for normal tasks. (use)
4. Access should be granted only authorised users. (preposition)
5. Reduce risk by unnecessary permissions. (remove)
6. Services that sensitive information must be monitored. (process)

Ver las respuestas

1. review
2. be encrypted
3. use
4. to
5. removing
6. process

🧩 Choose the Correct Option

1. Users should receive only / every permission they need.
2. Administrative accounts must be protected / protected.
3. Unknown devices should be considered untrusted / trusting.
4. Use segmentation to limit / limiting the blast radius.
5. Reduce risk by reviewing / review privileges regularly.
6. Secure default settings are safer than / safest that open default settings.

Ver las respuestas

1. only
2. be protected
3. untrusted
4. to limit
5. reviewing
6. safer than

🗣️ Speaking and Writing Practice

Responde las siguientes preguntas en inglés:

1. Why is least privilege important?
2. How can an organisation separate responsibilities?
3. Should internal users always be trusted?
4. What security controls are part of defence in depth?
5. What could happen if a cloud resource is public by default?
6. How would you explain Zero Trust to a non-technical person?

Example:

Least privilege is important because it reduces unnecessary access. If an account is compromised, the attacker can perform only the actions allowed by that account. This limits the potential damage.

📝 Write a Security Recommendation

Completa esta recomendación utilizando el vocabulario aprendido:

Organisations should ____________________________________.

Users must not __________________________________________.

Sensitive resources should be ___________________________.

Access should be granted only when ______________________.

Network segmentation can help ___________________________.

The main objective is to ________________________________.

Final thought:

Strong security architecture begins by limiting trust, reducing unnecessary access and designing every control with the possibility of failure in mind. 🔐🛡️