Study Hub / ISC2 CISSP (CISSP) / Domain 3.0
CISSP Domain 3.0: Security Architecture and Engineering — Explained
Domain 3.0 is engineering security into systems: the models that define safe behavior, the cryptography that enforces it, the physical controls people forget, and how it all maps to cloud. The most technical CISSP domain — in plain English.
Security models: the rules of safe systems
- Bell-LaPadula — confidentiality: no read up, no write down. Subjects can't read above their clearance or write below it (prevents leaks). The classified-government model.
- Biba — integrity: no read down, no write up. The mirror image — prevents low-integrity data from contaminating high-integrity processes.
- Clark-Wilson — integrity for commerce: well-formed transactions, separation of duties, audit trails. The "accounting system" model.
- Others to recognize — Brewer-Nash/Chinese Wall (conflict-of-interest separation), Graham-Denning (how subjects/objects securely interact), Harrison-Ruzzo-Ullman (safety decidability).
- Evaluation criteria — Common Criteria (international, EAL levels), and the idea of certification (technical evaluation) vs. accreditation (management authorization to operate).
Cryptography: the working concepts
- Symmetric vs. asymmetric — symmetric (one shared key: AES — fast, bulk encryption; key distribution is the hard part) vs. asymmetric (key pairs: RSA, ECC — slow, solves distribution; public encrypts, private decrypts).
- What each provides — encryption gives confidentiality; hashing (SHA-256) gives integrity (any change breaks the hash); digital signatures (hash + private key) give integrity + authentication + non-repudiation.
- PKI — certificates bind identities to public keys; CAs issue them; revocation (CRL/OCSP) handles compromise. The chain of trust makes the whole thing work — break the CA and everything downstream falls.
- Key management — generation (proper randomness), distribution, storage (HSMs), rotation, destruction. Cryptography fails at key management far more often than at math.
- What to avoid — DES (broken), MD5/SHA-1 (collision-broken for signatures), homegrown ciphers. "Don't roll your own crypto" is industry law.
Physical security and cloud architecture
- Physical controls — perimeter (fences, bollards), entry (badges, biometrics, mantraps), surveillance (CCTV), environmental (fire suppression — clean agent for server rooms, not sprinklers; HVAC; UPS/generators). The layer everyone forgets until a flood.
- Defense in depth — layered controls so no single failure is fatal: physical + technical + administrative, each backing the others.
- Cloud security concepts — shared responsibility (provider secures the platform, you secure your data/configs), virtualization security (hypervisor as trust boundary, VM escape as the nightmare), container isolation limits.
- System vulnerabilities — client/server, database, and web threats at the architecture level: design them out from the start (input validation, least privilege in service accounts, encrypted data flows), not just patch them later.
- Embedded and IoT — constrained devices with unpatchable firmware: segment them, assume compromise, never trust them with crown jewels.
The must-memorize table: crypto primitives
What each primitive provides.
| Primitive | Provides | Example |
|---|---|---|
| Symmetric encryption | Confidentiality (fast, bulk) | AES |
| Asymmetric encryption | Confidentiality + key distribution | RSA, ECC |
| Hashing | Integrity (tamper detection) | SHA-256 |
| Digital signature | Integrity + authentication + non-repudiation | RSA/ECDSA sign |
| HMAC | Integrity + authenticity (shared key) | HMAC-SHA-256 |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A multilevel-secure system must prevent users from reading data above their clearance and writing data to lower levels. Which model describes this?
- A. A. Biba
- B. B. Bell-LaPadula — no read up, no write down (confidentiality)
- C. C. Clark-Wilson
- D. D. Brewer-Nash
Show answer & reasoning
B. Bell-LaPadula is the confidentiality model: subjects can't read up (see secrets above clearance) or write down (leak secrets downward). Biba (A) is its integrity mirror (no read down, no write up). "Prevent leaks" → Bell-LaPadula.
2. A contract must prove who signed it and that it wasn't altered — and the signer must not be able to deny signing. Which cryptographic tool provides all three?
- A. A. AES encryption
- B. B. SHA-256 hashing alone
- C. C. A digital signature — hash encrypted with the signer's private key: integrity + authentication + non-repudiation
- D. D. HMAC
Show answer & reasoning
C. Only digital signatures deliver the full trio: the hash proves integrity, the private key proves who (authentication), and only the key holder could have made it (non-repudiation). AES (A) gives confidentiality only; plain hashing (B) proves integrity but not who. Signatures are the "prove it was you and it's intact" tool.
3. A company deploys badge readers at the entrance, a mantrap, CCTV, and clean-agent fire suppression in the server room. Which security principle does this layering demonstrate?
- A. A. Least privilege
- B. B. Defense in depth — layered physical controls so no single failure exposes the asset
- C. C. Separation of duties
- D. D. Fail-open design
Show answer & reasoning
B. Defense in depth = overlapping layers (perimeter → entry → surveillance → environmental), each catching what the previous missed. A tailgater beating the badge reader still faces the mantrap and cameras. Single controls fail; layers endure. (And clean agent, not water, for server rooms — sprinklers destroy what fire didn't.)
4. Two parties need to exchange encrypted messages but have no secure way to share a secret key first. Which cryptographic approach solves the distribution problem?
- A. A. AES with a longer key
- B. B. Asymmetric cryptography — publish public keys openly; private keys never travel
- C. C. ROT13
- D. D. Hashing the messages
Show answer & reasoning
B. Asymmetric crypto exists to solve key distribution: public keys can travel over insecure channels because only the private key decrypts. (In practice: use asymmetric to exchange a temporary symmetric session key, then AES for speed — hybrid encryption, the best of both.) AES alone (A) still needs the shared secret delivered somehow.
This was one domain. The simulator drills all 8.
This free preview covered Security Architecture & Engineering (Domain 3.0, 13%). Not covered here: Communication & Network Security (Domain 4.0, 13%); Security Assessment & Testing (Domain 6.0, 12%); Security Operations (Domain 7.0, 13%). The three most operational domains — network security, assessment, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CISSP Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy