Capstone Project — Security Architecture
Designing a Secure Network Architecture and Performing Risk Assessment
This project focuses on designing a secure network architecture for a simulated organization, identifying risks, and implementing controls such as segmentation, firewall rules, and least privilege to reduce attack surface and limit lateral movement.
Context and Objective
Many organizations operate with flat networks or poorly structured segmentation, which increases the risk of lateral movement once an attacker gains access. This project was designed to address that problem by building a more secure and structured network model.
The objective was to design a network for a fictional company that supports business operations while also reducing risk through proper segmentation, controlled access, and visibility into traffic between systems.
Instead of focusing only on diagram creation, this project also includes risk assessment, control justification, and explanation of how each decision improves the overall security posture.
Approach
I approached this project by thinking through how an organization’s systems should be separated based on function and risk. This led to designing multiple network segments rather than placing everything on a single network.
The architecture includes internal systems, external-facing services, and protected zones, all separated using VLANs and controlled communication paths. Firewall rules are used to restrict traffic between these segments based on necessity.
Each design decision was made with a specific goal: reduce attack surface, limit unnecessary access, and make it more difficult for an attacker to move freely within the network.
Architecture Design
The network is divided into multiple segments, including internal user systems, servers, and a demilitarized zone (DMZ) for externally-facing services. This separation helps control how traffic flows between systems and reduces exposure.
The DMZ is designed to host public-facing services while isolating them from critical internal systems. If a service in the DMZ is compromised, segmentation helps prevent direct access to sensitive internal resources.
Firewall rules enforce strict communication paths between segments, allowing only necessary traffic while blocking unnecessary or risky connections. This reduces the ability for unauthorized movement across the network.
This design follows core security principles such as least privilege, segmentation, and controlled access, all of which contribute to a stronger and more resilient network.
Risk Assessment
A key part of this project was identifying potential risks within the network and evaluating how they could impact the organization. This included risks such as unauthorized access, lateral movement, exposed services, and misconfigured permissions.
Each identified risk was analyzed and paired with recommended controls. These controls included segmentation, firewall rules, restricted access, and improved monitoring.
The goal was not just to list risks, but to understand how they connect to real systems and how design decisions can reduce their impact.
Skills and Concepts Demonstrated
This project demonstrates security architecture thinking, risk-based decision making, and understanding of how network design impacts security. It also reflects the ability to translate technical concepts into structured documentation.
Why This Project Matters
This project demonstrates the ability to think beyond individual systems and understand how an entire network should be structured to reduce risk. It shows how design decisions affect security outcomes.
It also highlights the importance of planning and architecture in cybersecurity. Many security issues originate from poor design, and this project focuses on addressing those issues at the foundation level.
Combined with hands-on lab work, this project shows both sides of security: building secure systems and detecting issues within them.
Reflection and Improvements
One area I would improve in this project is the inclusion of cloud-based storage and services. While the architecture focuses on on-premise-style segmentation and control, modern environments often rely on cloud platforms for storage, logging, and system integration.
Adding cloud storage would introduce additional considerations such as access control, identity management, logging visibility, and secure data handling. It would also allow the architecture to better reflect hybrid or cloud-integrated environments, which are more common in real-world organizations.
This is something I plan to incorporate into future projects as I expand further into cloud security and architecture design.
Project Walkthrough
This walkthrough provides a high-level explanation of the architecture, design decisions, and how the environment was structured. It complements the written report by showing the reasoning and thought process behind the implementation.
Note: This video was recorded using voice-to-text assistance due to a noisy environment and a speech impairment. The goal was to ensure clarity while still explaining the project effectively.
Full Report and Supporting Documentation
The full report includes network diagrams, architecture decisions, risk analysis, and detailed explanations of the controls used.