<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-secure-data-architecture
description: >-
  Design data architectures with classification-driven encryption, access controls,
  data loss prevention, privacy-preserving storage patterns, and lifecycle management
  to protect sensitive data across all states.
domain: cybersecurity
subdomain: security-architecture
tags:
  - data-classification
  - encryption
  - dlp
  - data-masking
  - privacy
  - data-lifecycle
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Designing Secure Data Architecture

## Overview

Secure data architecture applies classification-driven controls to protect data at rest,
in transit, and in use. This skill covers data classification schemas, encryption
strategies, tokenization, data masking, DLP policies, and retention lifecycle management.

Mode: `[MODE: ARCHITECT]` — Data security design and classification.

## Prerequisites

- Data inventory or catalog
- Classification policy
- Encryption key management (KMS, Vault)
- Python 3.10+

## Key Concepts

### Data Classification Levels

| Level | Label | Examples | Controls |
|-------|-------|---------|----------|
| 4 | **Restricted** | PII, PHI, payment data, credentials | AES-256, column-level ACL, DLP, audit |
| 3 | **Confidential** | Internal financials, trade secrets | AES-256, role-based access, logging |
| 2 | **Internal** | Internal docs, configs | Encryption at rest, SSO access |
| 1 | **Public** | Marketing, published APIs | Integrity checks, CDN |

### Encryption Strategy by Data State

```
┌─────────────────────────────────────────────────────┐
│                    Data States                       │
├──────────────┬──────────────┬───────────────────────┤
│  At Rest     │  In Transit  │  In Use               │
├──────────────┼──────────────┼───────────────────────┤
│ AES-256-GCM  │ TLS 1.3      │ Tokenization          │
│ KMS-managed  │ mTLS         │ Format-preserving enc  │
│ Column-level │ Certificate  │ Confidential computing │
│ File-level   │   pinning    │ Secure enclaves        │
└──────────────┴──────────────┴───────────────────────┘
```

### Data Flow with Classification Tags

```json
{
  "data_flows": [
    {
      "name": "user-registration",
      "source": "web-client",
      "destination": "user-db",
      "data_elements": [
        {"field": "email", "classification": "restricted", "pii": true},
        {"field": "name", "classification": "confidential", "pii": true},
        {"field": "preferences", "classification": "internal", "pii": false}
      ],
      "encryption": "tls_1.3",
      "storage_encryption": "aes_256_gcm",
      "retention_days": 730,
      "masking_required": true
    }
  ]
}
```

### DLP Policy Configuration

```yaml
dlp_policies:
  - name: block-pii-external
    classification: restricted
    action: block
    channels: [email, cloud-storage, usb]
    patterns:
      - type: regex
        pattern: '\b\d{3}-\d{2}-\d{4}\b'
        label: SSN
      - type: regex
        pattern: '\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
        label: credit-card
    notification: security-team
    log: true
```

## Workflow

### Step 1: Classify Data Assets

```bash
node scripts/agent.js --action classify --catalog data-catalog.json
```

### Step 2: Design Encryption Strategy

```bash
node scripts/agent.js --action encrypt --catalog classified.json --output encryption.json
```

### Step 3: Generate DLP Policies

```bash
node scripts/agent.js --action dlp --catalog classified.json --output dlp-policies.json
```

### Step 4: Validate Data Protection

```bash
node scripts/agent.js --action validate --policies encryption.json --dlp dlp-policies.json
```

## Detection

```yaml
title: Designing Secure Data Architecture Detection
id: daf63971-3c9f-478b-80cf-fd10e140d170
status: experimental
description: Detects suspicious activity related to designing secure data architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```

## Verification

- [ ] All data assets classified with sensitivity levels
- [ ] Restricted data encrypted at rest with KMS-managed keys
- [ ] PII fields identified and masking rules applied
- [ ] DLP policies block restricted data exfiltration
- [ ] Retention policies enforce deletion schedules
- [ ] Backup data encrypted with separate key hierarchy
- [ ] Data flow diagrams include classification annotations

## References

- [NIST SP 800-122 PII Confidentiality](https://csrc.nist.gov/publications/detail/sp/800-122/final)
- [NIST SP 800-57 Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
- [GDPR Article 25 — Data Protection by Design](https://gdpr-info.eu/art-25-gdpr/)
