Writing
Systems & Security
A digital product depends on more than its visible features. Networks, architecture, application controls and everyday operations determine whether it works reliably and protects the people who use it.
This framework provides a practical method for examining those technical foundations, identifying weaknesses and making improvements that can be verified.
Understand — Map the system, its architecture and dependencies.
Assess — Evaluate its configuration, implementation and operation against relevant technical principles and controls.
Improve — Identify priorities, implement changes and verify improvements.
Start with the product’s needs and the boundaries of the assessment. Record what supports each observation, prioritise by impact and revisit the system after changes.
The pillars provide four connected views of the same system. Follow a question across them: an application failure may begin in a network, a deployment or an operational dependency.
01
How systems communicate.
Follow a request from the client to the service and back. This pillar examines whether communication is correctly configured, reliable and secure, including the intermediaries that resolve, route, encrypt and cache traffic.
02
How systems are built and deployed.
Map the components, dependencies and environments that support the product. Assess whether the architecture fits its needs, remains maintainable and makes infrastructure risks visible.
03
How systems are protected.
Examine the boundaries that protect application functionality, users and data. This pillar connects security principles to the way features are designed, implemented and changed.
04
How systems are maintained.
Consider what happens when a system slows down, fails or loses a dependency. Assess whether problems can be detected, diagnosed and recovered from, and whether the product is ready for everyday operation.
The pillar pages describe example assessment questions and possible improvements. They are a guide to applying the method, not completed checks or audit results.
Future project assessments may combine manual and automated checks with findings, evidence, recommendations and remediation tracking. This standalone framework establishes the method those assessments will follow.