Security starts with architecture

The way security groups are typically structured is flawed. There is an invariable disconnect between where and how security policies are framed, security is enforced, and security is audited.