Security Architecture and Design
Security Architecture and Design asks you to reason from principles to a defensible design: which model enforces the property you need, where the trust boundary sits, and what assurance the components actually claim. Items rarely ask for a definition; they describe a system and expect you to pick the control, model, or evaluation claim that is correct for it.
Start from principles, not products
- Least privilege, defense in depth (layered, different controls), separation of duties, abstraction, fail-safe defaults, complete mediation, and attack-surface minimization.
- The reference monitor must mediate every access, be tamper-proof, and be verifiable. The Trusted Computing Base is everything that must be trusted for the policy to hold - including firmware, hypervisor, and management planes in a cloud design.
Models map to a security property
- Bell-LaPadula protects confidentiality: no read up (simple security property), no write down (*-property).
- Biba protects integrity: no read down, no write up.
- Clark-Wilson protects integrity through well-formed transactions, constrained data items, and enforced separation of duty.
- Brewer-Nash (Chinese Wall) prevents conflict of interest across client datasets.
- Harrison-Ruzzo-Ullman models access matrices; general safety is undecidable.
Assurance versus capability
Common Criteria EAL1-EAL7 measures confidence in the evaluation and testing, not the strength or feature set of the product; an EAL4+ product can be functionally weaker than an unevaluated one. Architecture frameworks such as SABSA (risk-driven, business-attribute tracing), TOGAF, and Zachman organize the design work rather than supply controls.
Worked example
A multi-tenant SaaS stores HR records labelled internal/confidential/restricted, and no tenant may ever read another tenant's data. Name the property first. Tenant isolation is mandatory regardless of owner discretion, so discretionary access alone fails - a data owner could grant cross-tenant access - and label-based mandatory enforcement or per-tenant cryptographic keys is required. Classification levels map to Bell-LaPadula for confidentiality. If the concern were instead that only validated payroll processes may alter amounts, that is integrity, and Biba or Clark-Wilson applies. The reasoning order is: property, then model, then mechanism.
Traps that cost marks
- Reversing Bell-LaPadula or Biba rules under time pressure.
- Reading EAL7 as "most secure product".
- Treating the Chinese Wall as a classification-label model.
- Leaving the hypervisor or cloud control plane outside the TCB.
- Calling duplicated identical controls "defense in depth".