Problem
Security is often an afterthought. Breaches cost millions. Need systematic patterns from code to runtime.
security-complianceestablished · high operational burden
Security Patterns
Also known as: security-patterns, appsec, devsecops, zero-trust-patterns, auth-patterns
Intent
Comprehensive security patterns: authentication, authorization, encryption, secrets, supply chain, runtime — defense in depth.
Forces
- •Shift left: security in design, code, pipeline, runtime
- •Zero trust: never trust, always verify
- •Defense in depth: multiple layers, no single point
- •Compliance: GDPR, SOC2, PCI DSS, HIPAA, FedRAMP
Solution
✓ When to Use
- •Any production system
- •Regulatory requirements (SOC2, PCI, HIPAA, GDPR)
- •Customer trust is business critical
✗ When Not to Use
- •Pre-product (security debt acceptable)
- •Team not ready for security investment
Pros
- +Reduces breach risk and blast radius
- +Enables compliance, customer trust
- +Shifts left: catch issues early
- +Defense in depth: no single point of failure
Cons
- −Operational overhead: tools, processes, training
- −Velocity impact: gates, reviews, scanning
- −Complexity: many tools, overlapping concerns
- −Cost: tools, training, audit, certification
Cost Profile
Infrastructure
Medium — tools, scanning, monitoring
Operational
High — processes, gates, rotation, audits
Cognitive
High — many domains, evolving threats
Failure Modes
Security theater: tools installed, not configured
Alert fatigue: too many findings, no triage
Secrets in code: despite tools, culture gap
Supply chain breach: dependency compromised
Compliance checkbox: audit passed, reality different
Real-World Examples
Alternatives
- minimal-security
- compliance-only
- reactive-security
Related Patterns
- zero-trust
- mTLS
- secrets-management
- supply-chain-security
- runtime-security
- compliance
- api-gateway-auth
- security-headers
Competency Domains
security compliancedistribution communicationreliability opsdeploymenteconomics evolution