Tutorial 4: Modeling Security Controls & Compliance

In Tutorial 3, you mapped NeoBank's business capabilities and scored them with the TIME framework.

In modern financial institutions, security and governance are not afterthoughts — they are first-class architectural concerns. Regulators require strict traceability between sensitive data assets, policies, controls, and technical infrastructure.

In this tutorial, you will learn how to:

1. Define Trust Boundaries that enclose sensitive zones (e.g. PCI enclaves).
2. Model Regulatory Standards (PCI-DSS, SOX) and enterprise security policies.
3. Catalog Preventive Controls (WAF, MFA, data tokenization).
4. Identify STRIDE Threats and Vulnerabilities with CVSS scores.
5. Project a Threat Model View (threat_model) and a Compliance Matrix View (compliance_matrix).

---

1. Expanding the NeoBank Workspace Layout

We will add two new domain fragments under security/ and governance/:

neobank/
├── main.ea
├── strategy/
│   └── goals_kpis.ea
├── business/
│   ├── actors_processes.ea
│   └── capabilities.ea
├── application/
│   └── customer_onboarding.ea
├── technology/
│   └── environments.ea
├── security/
│   └── security_architecture.ea          # [NEW] Trust boundaries, controls, threats & vulns
└── governance/
    └── policies.ea                       # [NEW] Regulatory standards & policies

---

2. Define Security Architecture (security/security_architecture.ea)

Create security/security_architecture.ea. Here we model external and internal trust boundaries, mitigating controls, STRIDE threats, and known vulnerabilities:

neobank/security/security_architecture.ea

layer "Security Architecture" {

    trust_boundary tb_public_internet "Public Internet Zone" {
        description "Untrusted public perimeter accessible by internet-facing mobile apps and attackers"
        zone_type "Public"

        encloses {
            app_mobile_banking
        }
    }

    trust_boundary tb_pci_secure_enclave "PCI Secure Enclave" {
        description "Isolated VPC enclave holding payment gateways and cardholder data environments (CDE)"
        zone_type "Restricted"

        encloses {
            system_core_banking
            data_customer_record
        }
    }

    control control_waf "Web Application Firewall" {
        description "Cloudflare edge WAF with rate limiting and automated DDoS mitigation"
        control_type "Preventive"
        control_category "Network Security"
        effectiveness "High"
        implementation_status "Implemented"

        relationships {
            this protects app_mobile_banking "Filters incoming malicious HTTP requests"
            this mitigates threat_ddos "Absorbs distributed volumetric traffic spikes"
        }
    }

    control control_card_tokenization "PAN Card Tokenization Vault" {
        description "Replaces sensitive Primary Account Numbers with irreversible tokens"
        control_type "Preventive"
        control_category "Cryptography"
        effectiveness "High"
        implementation_status "Implemented"

        relationships {
            this protects data_customer_record "Ensures card numbers are never stored in plaintext"
        }
    }

    threat threat_credential_stuffing "Automated Credential Stuffing Attack" {
        description "Automated botnets attempting leaked username/password combinations"
        category "Spoofing"
        mitigation_status "Mitigated"
        criticality "High"

        relationships {
            this threatens app_mobile_banking "Targets customer authentication endpoint"
        }
    }

    threat threat_ddos "Distributed Denial of Service (DDoS)" {
        description "L7 application-layer flood designed to overwhelm payment services"
        category "DenialOfService"
        mitigation_status "Mitigated"
        criticality "Critical"

        relationships {
            this threatens app_mobile_banking "Floods API ingress gateways"
        }
    }

    vulnerability vuln_missing_rate_limiting "Missing Rate Limiting on Login Endpoint" {
        description "Authentication API does not throttle rapid repeated login attempts"
        cve_id "CVE-2025-41928"
        cvss_score 7.5
        severity "High"

        relationships {
            this affects app_mobile_banking "Allows fast-paced automated credential attacks"
        }
    }
}

---

3. Define Governance & Policies (governance/policies.ea)

Create governance/policies.ea. Here we model international regulatory standards and bind them to our systems and controls:

neobank/governance/policies.ea

layer "Governance & Policy" {

    standard standard_pci_dss "PCI DSS v4.0" {
        description "Payment Card Industry Data Security Standard requirements for protecting cardholder data"
        standard_type "Regulatory"
        authority "PCI Security Standards Council"

        relationships {
            this mandates control_card_tokenization "Requirement 3.4: Render PAN unreadable"
            this governs system_core_banking "Enforces audit logs and access controls on core banking"
        }
    }

    standard standard_sox "Sarbanes-Oxley Act (SOX 404)" {
        description "Internal controls and auditability over financial ledger reporting systems"
        standard_type "Regulatory"
        authority "SEC"

        relationships {
            this governs system_core_banking "Requires immutable transactional ledger audit trails"
        }
    }

    policy policy_data_privacy "Enterprise Data Privacy Charter" {
        description "Mandatory customer data protection policy complying with GDPR, CCPA, and GLBA"
        policy_type "Security"
        enforcement "Mandatory"
        priority "Critical"

        relationships {
            this governs data_customer_record "Mandates least-privilege access and purpose limitation"
        }
    }
}

---

4. Add Security Views to main.ea

In main.ea, add two dedicated security views to the views { ... } block:

1. threat_model: Renders STRIDE threats, vulnerabilities, trust boundaries, and controls.
2. compliance_matrix: Renders an audit matrix showing regulatory coverage across systems and data.

neobank/main.ea (excerpt)

    views {
        // ... previous views ...

        threat_model threat_model_view "NeoBank Threat Model" {
            description "STRIDE threat model mapping threats, vulnerabilities, and mitigating security controls across trust boundaries."
            tags ["Security", "Threat Model", "STRIDE", "Controls"]

            include app_mobile_banking
            include system_core_banking
            include data_customer_record
            include tb_public_internet
            include tb_pci_secure_enclave
            include control_waf
            include control_card_tokenization
            include threat_credential_stuffing
            include threat_ddos
            include vuln_missing_rate_limiting

            auto_layout LeftToRight
        }

        compliance_matrix compliance_matrix_view "Regulatory Compliance Matrix" {
            description "Regulatory and policy compliance coverage across core banking systems and data assets."
            tags ["Governance", "Compliance", "PCI-DSS", "SOX", "Audit"]

            include standard_pci_dss
            include standard_sox
            include policy_data_privacy
            include system_core_banking
            include data_customer_record
            include control_card_tokenization

            auto_layout TopToBottom
        }
    }

---

5. Visual Projections

View 1: threat_model_view

STRIDE threat model showing trust boundaries, threats, vulnerabilities, and mitigating controls

Key Features Promoted in this View:

• Trust Boundary Containment (encloses): Automatically groups and renders dotted boundary containers around assets.
• Threat & Vulnerability Lineage: Traces which threats target which apps, and how controls mitigate those specific threats.
• STRIDE Categorization: Automatically colors and symbols threats based on their category (Spoofing, DenialOfService, etc.).

---

View 2: compliance_matrix_view

Regulatory compliance matrix showing standard mandates and governed banking systems

Key Features Promoted in this View:

• Matrix Projection (compliance_matrix): Transforms relationship graphs into tabular compliance cross-references.
• Multi-Standard Auditability: Provides Chief Information Security Officers (CISOs) with instant visibility into which systems comply with PCI-DSS and SOX.

---

6. Validate the Security Architecture

Run validation:

scapius validate ./neobank

Validation Successful! Workspace 'Neo Bank Enterprise Architecture' is valid.

---

Next Steps

With your security posture and compliance mandates clearly modeled, continue to Tutorial 5: Value Streams to model end-to-end customer value streams and data flow lifecycles.