> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/ccpnotes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/ccpnotes/architecting-on-the-cloud/well-architected-framework/2-security.md).

# 2) Security

* Ability to **protect data, systems, and assets** to **take advantage of cloud technologies to improve your security.**

## **Design Principles:**

* **Implement a strong identity foundation**: Centralize identity manage and use the principle of least privilege.<br>
* **Enable traceability**: Track logs and metrics and if anything is suspicious, take action immediately.<br>
* **Apply security at all layers**: Apply security everywhere (edge of network, VPC, load balancing, every instance and compute service, operating system, application, and code).<br>
* **Automate security best practices**<br>
* **Protect data in transit and at rest:** Use encryption, tokenization, and access control where appropriate.<br>
* **Keep people away from data:** Reduce or eliminate the need for direct access or manual processing of data.<br>
* **Prepare for security events**: Do incident response simulations and use tools with automation to increase your speed for detection, investigation, and recovery.