Flagship course · HLD · Security Systems· ~/academy/tracks/hld
High-Level Design for Security Systems
System design, security first. One framework you can run in any 45-minute round, the building blocks behind every secure design, and real "Design X" problems from the security world built up one requirement at a time.
4
Modules
13
Lessons
12
Design problems
12 h
Reading
01
The security HLD round
How the round works, the framework, the numbers to know.
FREE1 lessons
02
Design problems: Access & identity
The problems where the identity boundary is the system.
FREE4 lessons
- Design a zero-trust access gatewayDesign the system that replaces a corporate VPN: every request to a private app authenticated, authorised with identity and device context, proxied and logged. Built one requirement at a time, from a single proxy to a global, highly available control plane.Must know● Medium70 min
- Design an SSO identity providerDesign the identity provider a company of 20k employees logs in through: OIDC and SAML, MFA, sessions, risk signals, SCIM provisioning, key management and a 99.99 % availability story for the thing everything depends on.● Hard60 min
- Design an MFA and step-up serviceDesign the service that proves the second factor for 2 million users: TOTP, passkeys, push with number matching, risk-based step-up for sensitive actions, recovery that is not the weakest link, and a defence against MFA fatigue.Must know● Medium55 min
- Design an API authorisation gatewayDesign the edge that every public API call crosses: token validation without calling the IdP, JWKS caching that cannot be abused, scopes at the edge and fine-grained decisions where the data lives, per-tenant rate limits, and a 10 ms latency budget.● Medium55 min
03
Design problems: Telemetry & detection
The problems where volume, loss and latency fight each other.
🔒 PRO3 lessons
- Design a SIEM pipelineDesign the system that ingests 100 MB/s of security logs from endpoints, cloud and identity, never loses an authentication event, normalises everything to one schema, runs detections within a minute and keeps a year of searchable history at a price the CFO accepts.Must know● Hard75 min🔒
- Design an EDR telemetry pipelineDesign the backend for 50,000 endpoint agents: event collection at 1 kB/s each, process-tree reconstruction, real-time rules with a one-second budget, a response channel that can isolate a host, and a data lake for hunting, all without the agent becoming the attacker's best tool.● Hard55 min🔒
- Design a threat intelligence platformDesign the platform that turns 60 noisy feeds into indicators your SIEM, EDR and firewalls can act on: STIX/TAXII ingestion, normalisation and dedupe, scoring with decay, enrichment on a quota, distribution within each tool's limits, and a false-positive loop that makes feeds earn their place.● Hard60 min🔒
04
Design problems: Infrastructure & data
Secrets, keys, certificates, the edge and the vulnerability backlog.
🔒 PRO5 lessons
- Design a secrets managerDesign the service that every workload asks for credentials: authentication by workload identity, policy by path, an encrypted store rooted in an HSM, dynamic short-lived credentials for databases and clouds, leases, audit and a 99.99 % availability story for a service that, when down, stops deploys.Must know● Hard60 min🔒
- Design a DDoS protection edgeDesign the anycast edge that keeps a public API up under a 1 Tbps volumetric attack and a 200k rps application-layer attack, while real users keep getting through.● Hard50 min🔒
- Design PKI and certificate automationDesign the internal certificate authority and automation that issues millions of short-lived certificates to services, devices and people, with an offline root, online issuing CAs, transparency, revocation and monitoring that prevents the classic expiry outage.● Medium45 min🔒
- Design a vulnerability management platformDesign the system that turns millions of scanner findings into a prioritised, owned, SLA-tracked backlog: ingestion and dedupe across tools, enrichment with exploitability and exposure, ownership mapping, ticketing and the dashboards leadership actually reads.● Medium45 min🔒
- Design a key management serviceDesign the KMS every other system encrypts with: an HSM-backed root, envelope encryption, a key hierarchy that keeps the HSM out of the hot path, rotation and versioning, multi-region keys, dual control over root material, audit of every use, and caching of data keys without breaking AES-GCM limits.Must know● Hard60 min🔒