CISSP cheat sheet · Domain 3 · 13% of exam
Security Architecture and Engineering
How to design systems that are secure by default: design principles, formal security models, cryptography, cloud and embedded architectures, and physical security.
Crypto goal decoder
| Goal word in the stem | Goal | Answer |
|---|---|---|
| secret / only X can read / not intercepted | Confidentiality | Encrypt — receiver’s public key or AES (symmetric) |
| preserve / not altered / veracity / validate | Integrity | Hash (SHA-256). Ignore “Top Secret” background noise |
| integrity + authenticity with a shared key | Integrity + authentication | HMAC |
| cannot deny sending / non-repudiation | Non-repudiation | Digital signature with the sender’s private key (no confidentiality!) |
| unbreakable when implemented correctly | Perfect secrecy | One-time pad (Vernam) |
| agree a key over an insecure channel | Key exchange | Diffie-Hellman / ECDH (no data encryption; MITM risk without authentication) |
Security models
| Model | Protects | Rule / hook |
|---|---|---|
| Bell-LaPadula | Confidentiality | No read up, no write down (*-property). Does NOT stop covert channels |
| Biba | Integrity | No read down, no write up |
| Clark-Wilson | Commercial integrity | Well-formed transactions + separation of duties (subject → program → object) |
| Brewer-Nash | Conflict of interest | Chinese Wall: access to Bank A blocks Bank B |
| Information flow | Flow between levels | Detects covert channels |
| Take-Grant / Graham-Denning / HRU | Rights | How rights are passed, created and deleted |
Rule cards
| Design principles | Least privilege · defense in depth · secure defaults · fail securely (fail-safe for people) · separation of duties · keep it simple · zero trust · privacy by design · trust but verify · shared responsibility. |
|---|---|
| Trusted computing | TCB = all components enforcing security · Reference monitor = always invoked, tamper-proof, verifiable · Security kernel = its implementation. |
| Symmetric vs asymmetric | Symmetric: one shared key, fast, bulk data (AES 128-bit block; 128/192/256 keys; keys needed n(n−1)/2) · Asymmetric: key pair, slow, key exchange + signatures (RSA, ECC, DH; keys needed 2n). |
| Keys rule | Confidentiality → receiver’s PUBLIC key · Signature → sender’s PRIVATE key (“Lock for THEM, sign as ME”). |
| PKI | RA verifies identity · CA issues, signs and revokes · CRL = periodic revocation list · OCSP = real-time check · never escrow signing keys. |
| Post-quantum | NIST FIPS 203 (ML-KEM), 204 (ML-DSA), 205 (SLH-DSA). Build crypto-agility and a crypto inventory now. |
| NIST cloud characteristics | On-demand self-service · broad network access · resource pooling (multi-tenant) · rapid elasticity · measured service. |
| Cloud models | IaaS (you manage OS and up) · PaaS (apps and data) · SaaS (data and access) · Private / community / public / hybrid · CSA STAR: Level 1 self-assessment · Level 2 third-party · Level 3 continuous. |
| Evaluation | Common Criteria (ISO 15408): Protection Profile (needs) · Security Target (claims) · TOE · EAL1–EAL7 (EAL7 formally verified). |
| Fire | Stages: incipient → smoke → flame → heat · earliest detection = incipient (aspirating/VESDA) · rate-of-rise = heat detector · data centre water = pre-action · classes (US): A ordinary, B liquids, C electrical, D metals, K kitchen · human life first. |
| Power / HVAC | UPS = instant bridge; generator = startup gap · low humidity = static, high = corrosion · positive pressure keeps dust and smoke out. |
| Physical layers | Deter → Deny → Detect → Delay · 8 ft fence + barbed wire deters a determined intruder · mantrap stops tailgating · CPTED: natural surveillance, natural access control, territorial reinforcement. |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Hash | One-way fingerprint of data | File checksum | Integrity only |
| HMAC | Hash + shared secret key | API message check | Integrity + authenticity, no non-repudiation |
| Salt vs IV | Salt: random value added before hashing passwords · IV: random start value for encryption | Same password → different hashes | Passwords → salt; encryption → IV |
| Kerckhoffs’s principle | Only the key must be secret, not the algorithm | AES is public and still secure | Opposite of security through obscurity |
| ECB / CBC / GCM | ECB leaks patterns · CBC chains blocks · GCM encrypts + authenticates | The “ECB penguin” image | ECB = weakest mode |
| Perfect forward secrecy | Fresh key per session; an old key leak does not expose past sessions | ECDHE in TLS | Stolen server key ≠ old traffic exposed |
| Birthday attack | Finding two inputs with the same hash | Hash collision | Collisions → birthday |
| Meet-in-the-middle | Attack double encryption from both ends | Why 2DES is weak | — |
| Side-channel | Steal secrets from timing, power or sound | Measuring CPU power draw | Physical leakage |
| TEMPEST | Protection against electromagnetic emanations | Shielded rooms | EM leakage |
| Covert channel | Hidden, unauthorised path for data | Leaking bits via CPU timing | → information flow model |
| VM escape | Break out of a VM to the hypervisor | A tenant attacks the host | Biggest virtualisation risk |
| TPM / HSM | Chip on the motherboard for keys / dedicated key appliance | BitLocker uses a TPM | Keys belong here, never in code |
| ICS / SCADA | Systems that run physical processes | Power plant control | Availability + safety first |
| Mantrap | Two-door booth letting one person through at a time | Bank vault entry | Anti-tailgating (preventive) |
| Incipient | Very first stage of fire, before visible smoke | Aspirating detector (VESDA) | Earliest detection |