CISSP Domain 3—Security Architecture and Engineering—goes beyond simple policies and introduces the technical backbone of organizational security. Security engineering takes system architecture and applies principles to protect against human error, malicious acts, hardware failures, and natural disasters.
As IT professionals, understanding this domain is critical, because it bridges conceptual security models with practical implementation. You will learn not only how to secure systems but also how to evaluate, test, and maintain them in real-world environments.
Security Models: The Frameworks Behind Secure Systems
Security models provide blueprints for designing secure systems and ensuring policies are consistently enforced. Here’s a deep dive into the most relevant models:
Bell-LaPadula Model (Confidentiality)
- Focus: Confidentiality
- Rules:
- No Read Up (Simple Security Rule): Users cannot read data above their clearance.
- No Write Down (Star Rule): Users cannot write information to lower levels.
- Use Case: Military or government systems where secrecy is critical.
Biba Model (Integrity)
- Focus: Data integrity
- Rules:
- No Read Down: Prevents contamination from lower integrity levels.
- No Write Up: Prevents unauthorized modification of higher integrity data.
- Use Case: Financial systems where data accuracy is paramount.
Clark-Wilson Model
- Focus: Integrity through enforcement of separation of duties
- Mechanisms: Controlled programs (well-formed transactions) and auditing to prevent improper modification of data.
Brewer-Nash / Chinese Wall Model
- Focus: Contextual access control
- Goal: Prevent conflicts of interest by dynamically restricting access based on previous activities.
- Example: Consulting firms ensuring analysts cannot access competing clients’ sensitive data.
Non-Interference (Goguen-Meseguer)
- Focus: Multi-level security
- Principle: Low-level users cannot infer information about high-level operations.
- Importance: Prevents information leakage across sensitivity levels.
Graham-Denning Access Control Model
- Defines eight core rules for secure object and subject management, covering creation, deletion, and rights assignment.
- Relies on an Access Control Matrix (ACM), which maps subjects to objects and the permitted actions.
Sutherland and Lipner Models
- Sutherland: Maintains system integrity through predefined secure states and state transitions.
- Lipner: Combines Bell-LaPadula and Biba to provide both confidentiality and integrity.
Access Control Models: Enforcing Security in Practice
Mandatory Access Control (MAC)
- Data classified by sensitivity; user clearance determines access.
- Security modes: Dedicated, System High, Compartmented, and Multilevel.
- Environments: Hierarchical, compartmentalized, or hybrid.
Discretionary Access Control (DAC)
- Access based on identity or group membership.
- Users can transfer permissions unless restricted by MAC.
- Common in Linux/UNIX systems.
Role-Based Access Control (RBAC)
- Access is tied to roles rather than individuals.
- Simplifies administration, especially in large organizations.
Attribute-Based Access Control (ABAC)
- Policies combine user, resource, and environmental attributes.
- Decision points:
- PEP: Enforces access policies.
- PDP: Evaluates requests against policies.
- PIP: Provides necessary attribute data.
Security Evaluation and Certification
TCSEC (Orange Book)
- DoD standard for evaluating system security.
- Ratings range from D (minimal) to A1 (verified design).
Common Criteria (ISO/IEC 15408)
- International standard for evaluating security functionality and assurance.
- Key components:
- ST: Security Target defining product capabilities.
- SFRs: Security Functional Requirements.
- SARs: Security Assurance Requirements.
- EAL: Evaluation Assurance Levels 1–7.
ITIL and ISO 27001/27002
- ITIL: Operational framework for improving IT service management.
- ISO 27001/27002: Standards for security governance and control implementation.
- Capability Maturity Model (CMM): Guides progressive adoption of structured processes.
Security Capabilities of Information Systems
- Memory Protection & Process Isolation: Prevent unauthorized process interactions.
- Virtualization & TPM: Secure hypervisors and cryptographic operations.
- Fault Tolerance: Ensures availability during hardware or software failures.
- Interfaces & Encryption: Protect data in transit and provide non-repudiation.
Covert Channels and Nonces
- Covert timing/storage channels: Hard-to-detect methods for data exfiltration.
- Nonce/Initialization Vector: Ensures one-time-use cryptographic operations and prevents replay attacks.
Cryptography and Key Management
Symmetric vs. Asymmetric vs. ECC
- Symmetric: Fast, smaller keys, but key sharing is a challenge.
- Asymmetric: Secure key exchange; slower; used in PKI.
- Elliptic Curve Cryptography (ECC): Smaller keys, ideal for mobile and constrained environments.
Key Management Best Practices
- Creation, secure distribution, rotation, escrow, and destruction.
- PKI implementation includes certificate policies (CP) and practices statements (CPS).
Encryption Standards and Protocols
- AES, RSA, Twofish, Blowfish, DES/3DES
- Protocols: IPsec (AH, ESP, IKE), S/MIME, PGP, SET, E2EE, TLS/HTTPS
Hash Functions and Digital Signatures
- SHA-2, HMAC, ECDSA, DSA for authentication, integrity, and non-repudiation.
- X.509 certificates, CRL, OCSP for public key validation.
Fire Suppression and Physical Security
- Fire Extinguishers: Class-specific; CO², FM-200, FE-13 for electrical/server environments.
- Pipe Systems: Wet, Dry, and Deluge for automated water-based suppression.
- Perimeter Security: Fencing, lighting, and surveillance based on NIST recommendations.
- Regulatory Compliance: NFPA 75 mandates 60-minute fire exposure tolerance for IT environments.
Conclusion: Applying Security Architecture in Real-World IT
Domain 3 isn’t just theory—it’s about building resilient, auditable, and secure IT systems.
- Security models provide structured design principles.
- Access control frameworks translate policies into enforceable mechanisms.
- Cryptography, key management, and fire suppression ensure confidentiality, integrity, availability, and safety.
Pro tip: In practice, I’ve seen hybrid MAC/RBAC implementations paired with ABAC policies provide both granular control and operational flexibility, while structured fire suppression and redundancy plans maintain uptime during critical incidents.
Mastering Domain 3 equips IT professionals to design, evaluate, and defend systems against evolving threats, ensuring security is both practical and robust.
From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.