Certified Information Systems Security Professional (CISSP) Security Architecture and Engineering Syllabus

Security Architecture and Engineering syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Architecture and Engineering in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Secure Design Principles and Models

   3 topics

   • Engineering Secure Design Principles
     • Least privilege and need to know
     • Defense in depth and layered security
     • Secure defaults, fail-safe, and economy of mechanism
     • Zero trust and privacy by design
   • Security Models
     • Bell-LaPadula confidentiality model
     • Biba and Clark-Wilson integrity models
     • Brewer-Nash (Chinese Wall) and Take-Grant
   • Security Evaluation Criteria
     • Common Criteria, EAL, and protection profiles
     • Certification and accreditation processes
2. 2

   Fundamental Hardware and Software Architecture

   3 topics

   • System Components and Trusted Computing
     • CPU, memory, and protection rings
     • Trusted Computing Base and reference monitor
     • TPM and hardware security modules
   • Security Capabilities of Information Systems
     • Memory protection and process isolation
     • Virtualization and hypervisor security
     • Secure boot and measured launch
   • Vulnerabilities of Architectures
     • Client-based and server-based vulnerabilities
     • Database and large-scale parallel systems
     • Industrial control systems and IoT weaknesses
3. 3

   Cryptography Fundamentals

   4 topics

   • Cryptographic Concepts
     • Cryptographic lifecycle and algorithm selection
     • Confusion, diffusion, and Kerckhoffs's principle
     • Work factor and key length
   • Symmetric and Asymmetric Cryptography
     • Block and stream ciphers (AES, DES modes)
     • RSA, ECC, and Diffie-Hellman
     • Hybrid cryptosystems
   • Integrity and Authentication Primitives
     • Hash functions and collision resistance
     • Message authentication codes and HMAC
     • Digital signatures and non-repudiation
   • Public Key Infrastructure and Key Management
     • Certificate authorities and trust chains
     • Key generation, escrow, rotation, and revocation
     • Digital certificates and CRL/OCSP
4. 4

   Cryptanalysis and Attacks

   3 topics

   • Classic Cryptographic Attacks
     • Brute force and frequency analysis
     • Known-plaintext and chosen-ciphertext attacks
     • Birthday and meet-in-the-middle attacks
   • Implementation and Side-Channel Attacks
     • Timing and power analysis
     • Fault injection
     • Ransomware and key exfiltration
   • Emerging Cryptographic Concerns
     • Quantum computing threat to public key crypto
     • Post-quantum cryptography
5. 5

   Physical and Environmental Security

   3 topics

   • Site and Facility Design
     • Crime Prevention Through Environmental Design (CPTED)
     • Secure data center placement and construction
   • Physical Access Controls
     • Perimeter defenses, fences, and bollards
     • Locks, mantraps, and badge systems
     • Guards, dogs, and surveillance
   • Environmental and Utility Controls
     • Power: UPS, generators, and conditioning
     • HVAC, humidity, and temperature
     • Fire detection and suppression systems

Security Architecture and Engineering flashcards for Certified Information Systems Security Professional (CISSP)

25 of 91 cards from the Security Architecture and Engineering deck — real questions with worked answers.

1. What does the security principle 'least privilege' require?

   Subjects (users, processes) are granted only the minimum rights, permissions, and access necessary to perform their assigned tasks, and nothing more.

2. Define 'defense in depth' (layered security).

   Deploying multiple, overlapping controls of different types (administrative, technical, physical) in layers so that the failure of one control does not result in total compromise.

3. What is the principle of 'fail-safe' vs 'fail-secure' default?

   Secure design defaults to denial: when a control or system fails, it should fail in a state that protects security (fail-secure/fail-closed) rather than granting access. (Fail-safe prioritizes human safety, e.g., doors unlock in a fire.)

4. What is 'least common mechanism' in secure design?

   A principle of minimizing the amount of mechanism shared by multiple users/processes, because shared mechanisms are potential channels for information leakage and compromise.

5. What does 'Privacy by Design' emphasize?

   Embedding privacy proactively into systems and processes from the start (default settings, full lifecycle protection, end-to-end security) rather than bolting it on afterward.

6. What is the difference between 'open design' and 'security through obscurity'?

   Open design holds that security should not depend on the secrecy of the mechanism (only the keys); security through obscurity relies on hiding the design and is considered weak/unreliable on its own.

7. What three things does a 'trust but verify' / zero trust model assume?

   Zero trust assumes no implicit trust based on network location; it requires continuous verification of identity, device, and authorization for every access request (never trust, always verify).

8. State the access rule of the Bell-LaPadula model for confidentiality.

   Simple Security Property: no read up (a subject cannot read data at a higher level). Star (*) Property: no write down (a subject cannot write to a lower level). It protects confidentiality.

9. State the access rules of the Biba model and what it protects.

   Simple Integrity Property: no read down. Star (*) Integrity Property: no write up. Biba protects integrity (prevents low-integrity data from corrupting high-integrity data).

10. What does the Clark-Wilson model enforce and with what core concepts?

    Integrity through well-formed transactions and separation of duties. Subjects access Constrained Data Items (CDIs) only via Transformation Procedures (TPs), enforcing the access triple: subject–program–object.

11. What problem does the Brewer-Nash (Chinese Wall) model address?

    Conflicts of interest. Access to data is dynamically restricted based on what a subject has previously accessed, preventing access to competing parties' information.

12. What does the Graham-Denning model define?

    A set of eight primitive protection rights (commands) for securely creating/deleting subjects and objects and securely transferring, granting, or deleting access rights.

13. What is the Harrison-Ruzzo-Ullman (HRU) model concerned with?

    The integrity of access rights in a system; it defines how subjects' access rights can change and proves that the general safety question (whether a right can leak) is undecidable.

14. What is a 'state machine' security model?

    A model where the system is always in a secure state; every transition (state change) takes the system from one secure state to another, so the system is secure regardless of input or transition.

15. In the Bell-LaPadula model, what is the 'Strong Star Property'?

    A subject may read and write only at its own security level (no read up, no write down, and no write up) — used when read/write must occur at the same level.

16. What is the 'take-grant' protection model used to determine?

    It uses a directed graph with take, grant, create, and remove rules to analyze how rights can be passed between subjects and objects and whether a given access right is obtainable.

17. What are the seven evaluation levels (EAL) of the Common Criteria?

    EAL1 (functionally tested), EAL2 (structurally tested), EAL3 (methodically tested/checked), EAL4 (methodically designed, tested, reviewed), EAL5 (semiformally designed/tested), EAL6 (semiformally verified design/tested), EAL7 (formally verified design/tested).

18. In Common Criteria, what are the Target of Evaluation (TOE), Protection Profile (PP), and Security Target (ST)?

    TOE = the product/system being evaluated; PP = a customer's/community's set of security requirements/wants for a category of products; ST = the vendor's claimed security features and assurances for the specific TOE.

19. What did the TCSEC ('Orange Book') evaluate, and what do its divisions D, C, B, A mean?

    TCSEC evaluated confidentiality of standalone systems. D = minimal protection; C = discretionary protection; B = mandatory protection; A = verified protection (A is highest).

20. What did ITSEC evaluate that TCSEC did not?

    ITSEC (European) separately rated functionality (F) and assurance (E1–E6) and addressed confidentiality, integrity, and availability, not just confidentiality.

21. What is the Trusted Computing Base (TCB)?

    The totality of protection mechanisms (hardware, firmware, software) within a system that enforces the security policy. Its correct operation is what the system's security depends on.

22. Define the 'security perimeter' and 'reference monitor.'

    Security perimeter = the boundary separating the TCB from the rest of the system. Reference monitor = the abstract concept that mediates all access by subjects to objects, enforcing the access control policy.

23. What is the 'security kernel'?

    The hardware, firmware, and software elements of the TCB that implement the reference monitor concept. It must be tamperproof, always invoked (non-bypassable), and small enough to be verified.

24. What three properties must a reference monitor satisfy?

    It must be tamperproof, always invoked (non-bypassable/complete mediation), and small/simple enough to be thoroughly analyzed and verified (verifiable).

25. What is a Trusted Platform Module (TPM)?

    A dedicated hardware chip that provides secure cryptographic functions and tamper-resistant storage for keys, supporting features like full-disk encryption (e.g., BitLocker), remote attestation, and sealed storage.

See more Security Architecture and Engineering flashcards →

Planning Security Architecture and Engineering for Certified Information Systems Security Professional (CISSP)

Security Architecture and Engineering (Certified Information Systems Security Professional (CISSP)) FAQ