Multi-plane security architecture
I stopped thinking about security as a perimeter months ago. The mental model that replaced it is biological: security as an organism with specialized organs, each responsible for a different survival function. What emerged is a ten-plane architecture where each plane owns a distinct concern and communicates with its neighbors through well-defined interfaces.
Network handles encrypted mesh connectivity and DNS-level filtering. Control manages identity, authentication, and policy enforcement. Data covers encryption at rest, backup integrity, and access auditing. Application owns input validation, CSRF protection, CSP headers, and rate limiting. Compute isolates workloads and manages resource boundaries. Build secures the CI/CD pipeline itself — image signing, dependency scanning, and registry access controls.
The interesting planes are the last four. Bot runs adversarial red-team and blue-team agents, both driven by profile-defined behavioral scripts. Red agents probe for weaknesses using scripted attack patterns; blue agents learn to detect and neutralize those patterns. Security Operations aggregates threat intelligence, correlates events across planes, and executes automated response playbooks. ML Pipeline trains classifiers on behavioral data to detect anomalous sessions. Ops provides the human intervention layer for incidents that exceed automated thresholds.
The traditional model — network, application, data — leaves enormous gaps. Build-pipeline compromise is one of the most effective supply-chain attacks, yet most architectures treat CI/CD as a DevOps concern, not a security surface. Bot-traffic detection requires specialized behavioral analysis that does not belong inside generic application security. And ML-based detection needs its own pipeline lifecycle — training, validation, deployment, drift monitoring — that would pollute an application plane if it were mixed in there instead. Each plane has its own standards document defining its responsibilities, its interfaces with adjacent planes, and its failure modes. When a plane fails, the others continue operating. When an incident spans multiple planes, the security-operations plane coordinates the response.
The guiding principle is "attack first, train from that." Every defensive capability was built by first writing the attack that it needs to stop. The red-team bot plane is not an afterthought — it is the primary test harness. If the blue team cannot detect the red team's latest profile, that is a failing test, and the defense gets improved before the profile ships. This approach means security is never "done." The organism adapts because new attack profiles continuously pressure it to evolve. The alternative — a static firewall and some rate limiting — is how systems get breached while their operators believe they are protected.
← all logs