CISSP Domain 3 : Security Architecture and Engineering

Organizations must understand what they need to secure, why they need to secure it, and how it will be secured. This is also one of important domain to focus for CISSP exam. Out of 100% of the exam, this domain carries an weight of 12~13%. Following topics are discussed in this domain.

1. Secure Design principles
   • The Computer Architecture
   • System Security Mechanism
   • Security capabilities of Information system
   • System Security evaluation Model
2. Vulnerability Assessment & Mitigation
3. Cryptography
   • History, goals, concepts and Maths of Cryptography
     • Quiz – History, Goals, Concepts and Maths of Cryptography
   • Ciphers
   • Symmetric Key Cryptography
     • Practice Question – Symmetric Key Cryptography
   • Asymmetric Key Cryptography & Hybrid Cipher
   • Hash Functions & Digital Signature
     • Practice Question – Hashing
     • Practice Question – Digital Signature
   • Public Key Infrastructure & Key Management
   • Cryptanalytic attacks and Cryptography Life-cycle
     • Practice Question – Cryptanalytic attacks
4. Physical Security Requirements
   • Practice Question – Physical Security

Security engineering is based on design principles, practices, and models to ensure confidentiality, integrity, and the availability requirements of information assets. The end result could be the development of a product or supporting organizational processes. Further, the product could be hardware, software, or a combination of both.

1. IT assets can be grouped as software, hardware, and networking related
2. Software can be further grouped as operating systems, application software, embedded software, mobile applications, and web applications
3. Hardware and networking systems may contain embedded software
4. Security requirements should be addressed in a continual process through design, development and integration phases
5. Vulnerabilities might creep in during any of these phases
6. By adhering to software development engineering practices and security organizational processes, vulnerability issues can be addressed

Sensitive assets need protection from unauthorized disclosure or tampering. The sensitivity of assets is determined by confidentiality and integrity requirements and the impact of compromise on the corporation or national security. Cryptographic methods and solutions provide assurance to protect assets from compromise.

Refer to below picture for better clarity

1. Sensitive assets require an additional level of security pertaining to confidentiality and integrity.
2. Additional security requirements of confidentiality and integrity can be assured through the application of cryptographic methods.
3. The fundamentals of cryptography are related to encryption and the methods of encryption.
4. Various types of encryption methods are used in the cryptography domain based on their characteristics, such as the type of algorithm used, the key length, and the application.
5. Public Key Infrastructure (PKI) is an industry standard framework, which enables the integration of various services that are related to cryptography.
6. Key management techniques are important from the perspective of cryptographic key generation, distribution, storage, validation, and destruction.
7. Cryptographic key can be compromised. Compromises can be due to a weak algorithm or weak keys. Many methods of cryptanalytic attacks exist to compromise keys.
8. Cryptographic standards provide tools and best practice methods to secure information and keys from cryptanalytic attack

For many forward-thinking organizations, physical security considerations begin during site selection and design. These companies have learned that building in security is easier than patching the security after the fact. In this section, site selection and site building practices that can lead to increased physical security are covered.

Above both picture are taken from book “CISSP in 21 days” written by “M.L. Srinivasan”.