Ask HN: How do I architect secure web apps?

Let's say you are building an app with sensitive data - think a bank or healthcare. We have been brainstorming ideas and it seems like either my co-workers are over engineering or am I just not seeing it? These guys are all very sharp and more experienced than myself, so I need some help from you guys to point me in the right direction. My architecture: --------------------- ---FIREWALL--- DMZ: Web servers (talking to internal APIs & web services) ---FIREWALL--- Internal Layer 1: Web servers Running APIs talking to master databases directly DB Layer: Master database server with sensitive data restricted through SQL server built-in authentication and roles, etc... Their architecture: ------------------------ ---FIREWALL--- DMZ: Web server with a de-normalized read-only copy of the data we need ---FIREWALL--- Internal Layer 1: API servers and "platform databases" profiles, permission, etc... Internal Layer 2: Integration layer pushing and syncing data between layer 3 and above - probably pub/sub through SSIS (sql server integration services) Internal Layer 3: Master database server with sensitive data What do you all think? Is all the necessary work of pub/sub, multiple read-only databases and so on necessary? Does it really provide any extra security?