CISSP
Domain 3 · 13%
Security Architecture and Engineering
The theory-heaviest domain: formal security models, evaluation frameworks, how a trusted computing base is structured, cryptography, and physical security. The exam wants recognition of named models and what property each one actually enforces — not implementation detail.
Security models
- Bell-LaPadula — confidentiality. "No read up, no write down" (Simple Security Property, *-Property). Prevents a low-clearance subject from reading high data, and a high-clearance subject from leaking data down.
- Biba — integrity, the mirror image. "No write up, no read down." Prevents a low-integrity subject from corrupting high-integrity data.
- Clark-Wilson — integrity via well-formed transactions and separation of duties; access mediated through Constrained/Unconstrained Data Items and Integrity Verification/Transformation Procedures.
- Brewer-Nash (Chinese Wall) — dynamically changes permissions based on prior access, to prevent conflict-of-interest exposure (e.g. a consultant who accessed Client A's data can no longer access competitor Client B's).
- Graham-Denning — formally defines how subjects/objects are created, deleted, and how rights are granted/transferred.
Evaluation criteria
- TCSEC (Orange Book) — legacy US DoD standard, ratings D (minimal) through A1 (verified design); introduced the term Trusted Computing Base (TCB).
- Common Criteria (ISO/IEC 15408) — the modern international standard; a product's claims are stated in a Protection Profile, evaluated to an Evaluation Assurance Level (EAL1–EAL7).
System architecture concepts
- TCB — the totality of hardware, firmware, and software that enforces the security policy.
- Reference monitor — the abstract concept of mediating every access between subject and object.
- Security kernel — the actual implementation of the reference monitor concept.
- Protection rings — Ring 0 (kernel, most privileged) through Ring 3 (user applications, least privileged) in the classic model.
- Process isolation, layering, abstraction, data hiding — the general OS design techniques that keep one process from corrupting another.
Cryptography fundamentals
- Symmetric — one shared key, fast, hard key distribution problem (AES is the standard; DES/3DES are legacy).
- Asymmetric — key pair (public/private), solves key distribution, much slower — typically used to exchange a symmetric session key (RSA, ECC).
- Hashing — one-way, fixed-length output, used for integrity verification, not confidentiality (SHA-2/SHA-3; MD5 and SHA-1 are broken/deprecated).
- Digital signature — hash the message, encrypt the hash with the sender's private key; verifier decrypts with the sender's public key and compares — gives integrity, authentication, and non-repudiation together.
- PKI — Certificate Authority (issues/signs certs), Registration Authority (verifies identity before issuance), certificate revocation via CRL or OCSP.
- Key management is usually the actual weak point on the exam's "what went wrong" scenarios — generation, distribution, storage, rotation, and destruction of keys, not the algorithm itself.
Common cryptanalysis attack types to recognize by name: brute force, known-plaintext, chosen-plaintext, man-in-the-middle, and side-channel (timing, power analysis — attacking the implementation, not the math).
Secure design principles
Defense in depth (layered, no single point of failure), least privilege, fail secure vs. fail open (know which one a given control should do — a door lock should fail secure, a fire exit should fail open), separation of duties, keep it simple, zero trust (never trust, always verify, regardless of network location), and security through obscurity is not a control — it can be a layer, never the layer.
Physical security
Site/facility design uses CPTED (Crime Prevention Through Environmental Design) principles — natural surveillance, access control, territorial reinforcement. Layered physical controls: perimeter (fencing, lighting) → building (locks, mantraps) → interior (badges, cameras) → asset (cable locks, safes). Environmental controls cover HVAC, fire suppression classes (know that water is wrong for electrical/Class C fires; clean agents or CO₂ are used in data centers), and power protection (UPS for short-term, generator for extended outage).