Security architecture anti-patterns

Six design patterns to avoid when designing computer systems for organisational planning, review and training. NCSC guidance is advisory and should be applied to the organisation's own risks and obligations.

• Introduction
• Terminology
• Anti-patterns
• Trust
• Information technology vs operational technology
• Anti-pattern 1: 'Browse-up' for administration
• When administration of a system is performed from a device which is less trusted than the system being administered.
• How to identify this anti-pattern
• A better approach: 'browse-down'
• Further reading
• Anti-pattern 2: Management bypass
• When layered defences in a network data plane can be short-cut via the management plane.
• A better approach: layered defences in management planes
• Anti-pattern 3: Back-to-back firewalls
• When the same controls are implemented by two firewalls in series, sometimes from different manufacturers.
• A better approach: do it once, and do it well
• Source links

• v1.016/09/2026