Tutorial 4: Modeling Security Controls & Compliance
In Tutorial 3, you mapped NeoBank's business capabilities and scored them with the Capability Maturity Model.
In modern financial institutions, security and governance are not afterthoughts - they are first-class architectural concerns. Regulators require strict traceability between sensitive data assets, policies, controls, and technical infrastructure.
In this tutorial, you will learn how to:
- Define Trust Boundaries that enclose sensitive zones (e.g. PCI enclaves).
- Model Regulatory Standards (PCI-DSS, SOX) and enterprise security policies.
- Catalog Preventive Controls (WAF, MFA, data tokenization).
- Identify STRIDE Threats and Vulnerabilities with CVSS scores.
- Project a Threat Model View (
threat_model) and a Compliance Matrix View (compliance_matrix).
1. Expanding the NeoBank Workspace Layout
We will add two new domain fragments under security/ and governance/:
neobank/
├── main.ea
├── strategy/
│ └── goals_kpis.ea
├── business/
│ ├── actors.ea
│ └── capabilities.ea
├── application/
│ └── customer_onboarding.ea
├── technology/
│ └── environments.ea
├── security/
│ └── security_architecture.ea # [NEW] Trust boundaries, controls, threats & vulns
└── governance/
└── policies.ea # [NEW] Regulatory standards & policies
2. Define Security Architecture (security/security_architecture.ea)
Create security/security_architecture.ea. Here we model external and internal trust boundaries, mitigating controls, STRIDE threats, and known vulnerabilities:
neobank/security/security_architecture.ea
layer "Security Architecture" {
trust_boundary tb_public_internet "Public Internet Zone" {
description "Untrusted public perimeter accessible by internet-facing mobile apps and attackers"
boundary_type "Zone"
trust_level "Untrusted"
attr zone_type "Public"
relationships {
this encloses app_mobile_banking "Public internet can access the mobile banking app"
}
}
trust_boundary tb_pci_secure_enclave "PCI Secure Enclave" {
description "Isolated VPC enclave holding payment gateways and cardholder data environments (CDE)"
boundary_type "Zone"
trust_level "High"
attr zone_type "Restricted"
relationships {
this encloses system_core_banking "Core banking system resides in the PCI secure enclave"
}
}
control control_waf "Web Application Firewall" {
description "Cloudflare edge WAF with rate limiting and automated DDoS mitigation"
control_type "Preventive"
control_category "Network Security"
framework "PCI-DSS"
tags ["PCI-DSS", "Network Security"]
effectiveness "High"
implementation_status "Implemented"
relationships {
this protects app_mobile_banking "Filters incoming malicious HTTP requests" {
mechanism "Monitoring"
}
this mitigates threat_ddos "Absorbs distributed volumetric traffic spikes"
}
}
control control_card_tokenization "PAN Card Tokenization Vault" {
description "Replaces sensitive Primary Account Numbers with irreversible tokens"
control_type "Preventive"
control_category "Cryptography"
framework "PCI-DSS"
tags ["PCI-DSS", "Data Protection"]
effectiveness "High"
implementation_status "Implemented"
}
threat threat_credential_stuffing "Automated Credential Stuffing Attack" {
description "Automated botnets attempting leaked username/password combinations"
category "Spoofing"
likelihood "High"
impact "High"
risk_rating "High"
mitigation_status "Mitigated"
relationships {
this targets app_mobile_banking "Targets customer authentication endpoint"
}
}
threat threat_ddos "Distributed Denial of Service (DDoS)" {
description "L7 application-layer flood designed to overwhelm payment services"
category "DoS"
likelihood "Critical"
impact "Critical"
risk_rating "Critical"
mitigation_status "Accepted"
relationships {
this targets app_mobile_banking "Floods API ingress gateways"
}
}
vulnerability vuln_missing_rate_limiting "Missing Rate Limiting on Login Endpoint" {
description "Authentication API does not throttle rapid repeated login attempts"
cve_id "CVE-2025-41928"
cvss_score 7.5
relationships {
this targets app_mobile_banking "Allows fast-paced automated credential attacks"
}
}
}
3. Define Governance & Policies (governance/policies.ea)
Create governance/policies.ea. Here we model international regulatory standards and bind them to our systems and controls:
neobank/governance/policies.ea
layer "Governance & Policy" {
standard standard_pci_dss "PCI DSS v4.0" {
description "Payment Card Industry Data Security Standard requirements for protecting cardholder data"
standard_type "Regulatory"
tags ["PCI-DSS", "Regulatory"]
attr authority "PCI Security Standards Council"
relationships {
control_card_tokenization governed_by this "Requirement 3.4: Render PAN unreadable" {
status Compliant
}
system_core_banking governed_by this "Enforces audit logs and access controls on core banking" {
status Exempt
}
}
}
standard standard_sox "Sarbanes-Oxley Act (SOX 404)" {
description "Internal controls and auditability over financial ledger reporting systems"
standard_type "Regulatory"
tags ["SOX", "Regulatory"]
attr authority "SEC"
relationships {
system_core_banking governed_by this "Requires immutable transactional ledger audit trails" {
status Non-Compliant
}
}
}
policy policy_data_privacy "Enterprise Data Privacy Charter" {
description "Mandatory customer data protection policy complying with GDPR, CCPA, and GLBA"
policy_type "Security"
enforcement "Mandatory"
priority "Critical"
tags ["GDPR", "Privacy"]
attr framework "GDPR"
relationships {
system_core_banking governed_by this "Mandates least-privilege access and purpose limitation" {
status Compliant
}
}
}
}
4. Add Security Views to main.ea
In main.ea, add two dedicated security views to the views { ... } block:
threat_model: Renders STRIDE threats, vulnerabilities, trust boundaries, and controls.compliance_matrix: Renders an audit matrix showing regulatory coverage across systems and data.
neobank/main.ea (excerpt)
views {
// ... previous views ...
threat_model threat_model_view "NeoBank Threat Model" {
description "STRIDE threat model mapping threats, vulnerabilities, and mitigating security controls across trust boundaries."
tags ["Security", "Threat Model", "STRIDE", "Controls"]
include where layer == "Security Architecture"
include app_mobile_banking
include system_core_banking
auto_layout LeftToRight
}
compliance_matrix compliance_matrix_view "Regulatory Compliance Matrix" {
description "Regulatory and policy compliance coverage across core banking systems and data assets."
tags ["Governance", "Compliance", "PCI-DSS", "SOX", "Audit"]
include where layer == "Governance & Policy"
include_verb governed_by
}
}
5. Visual Projections
View 1: threat_model_view
STRIDE threat model showing trust boundaries, threats, vulnerabilities, and mitigating controls
Key Features Promoted in this View:
- Trust Boundary Containment (
encloses): Automatically groups and renders dotted boundary containers around assets. - Threat & Vulnerability Lineage: Traces which threats target which apps, and how controls mitigate those specific threats.
- STRIDE Categorization: Automatically colors and symbols threats based on their category (
Spoofing,DenialOfService, etc.).
View 2: compliance_matrix_view
Key Features Promoted in this View:
- Matrix Projection (
compliance_matrix): Transforms relationship graphs into tabular compliance cross-references. - Multi-Standard Auditability: Provides Chief Information Security Officers (CISOs) with instant visibility into which systems comply with PCI-DSS and SOX.
6. Validate the Security Architecture
Run validation:
scapius validate ./neobank
Validation Successful! Workspace 'Neo Bank Enterprise Architecture' is valid.
Next Steps
With your security posture and compliance mandates clearly modeled, continue to Tutorial 5: Value Streams to model end-to-end customer value streams and business capability realization.