We discussed security architecture design principles including the clarification of security by design and privacy by design. Security by design is focused on confidentiality, integrity, and availability (CIA) and design by privacy is more about the protection of privacy data. The industry-standard CSA, Google, PCI, or NIST provide good references. We can also refer to the OSA cloud computing pattern to understand the whole security architecture of a cloud service.
To build a security framework, we list some open source security frameworks to achieve some security controls instead of reinventing the wheel. For example, there is Spring Security and Shiro for web security frameworks in Java, and the Password Framework for NodeJS.
