We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 8-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Two login attempts arrive from the same user with the same correct password.
Login A: the user's registered MacBook, on the corporate VPN, at 10 AM Tuesday, from their usual city. Typical pattern. Low risk.
Login B: an unrecognized Windows laptop, on public Wi-Fi at an airport in a country the user has never visited, at 3 AM local time. Same valid credentials. Very different risk profile.
Traditional access control treats these identically. Valid password? You are in. Context-aware access control treats them differently. Login A proceeds normally. Login B triggers a hardware key challenge, limits access to read-only, and alerts the security team.
This is the foundation of zero trust. Google formalized it in BeyondCorp (published 2014), which replaced network-perimeter security with per-request context evaluation. Every request is evaluated. There is no "trusted network." The corporate office Wi-Fi does not automatically grant higher trust. Every signal, device posture, user behavior, network context, authentication strength, is evaluated together.
| Signal | What It Tells You | Risk Indicator |
|---|---|---|
| Device | Known/unknown, managed/unmanaged, OS patch level, disk encryption | Unknown device with outdated OS = higher risk |
| Location | Geographic position, network type (corporate, VPN, public) | Login from new country = higher risk |
| Time | When the access occurs relative to the user's normal pattern | 3 AM for a 9-5 worker = higher risk |
| Behavior | Typical actions vs current actions, data volume, access patterns | Downloading 10GB when user normally reads = higher risk |
| Authentication strength | How the user proved identity | Password-only vs hardware key = different trust levels |
| Session age | How long since last full authentication | 30-day-old session with no re-auth = higher risk |
| Resource sensitivity | Classification of what is being accessed | Public docs vs financial records = different thresholds |
Risk-adaptive responses:
| Risk Score | Response | Example |
|---|---|---|
| Low (0-25) | Normal access, no friction | Known device, office hours, corporate network |
| Medium (26-50) | Require MFA re-authentication | New location but known device |
| High (51-75) | Limit to read-only, require hardware key | Unknown device from new country |
| Critical (76-100) | Block access, alert security team, force password reset | Impossible travel + unknown device + abnormal behavior |