Security Architecture, Engineering, and Controls
Security models
Bell-LaPadula protects confidentiality: no read up, no write down. Biba protects integrity: no read down, no write up. Clark-Wilson enforces integrity through well-formed transactions and separation of duties. Brewer-Nash (Chinese Wall) prevents conflicts of interest. The reference monitor is the abstract enforcement mechanism; the trusted computing base is the set of components that must be trusted.
Secure design principles
Economy of mechanism, fail-safe defaults (deny by default), complete mediation, open design (security must not depend on secrecy of the design), separation of privilege, least privilege, least common mechanism and psychological acceptability.
Architecture and controls
Layered defense runs perimeter → network segmentation/DMZ → microsegmentation → host hardening → application controls → data protection. Zero trust replaces the "trusted internal network" assumption with continuous verification. Control categories are technical, managerial/administrative, operational and physical; types remain preventive, detective and corrective.
Crypto essentials
Symmetric (AES) is fast but has a key distribution problem; asymmetric (RSA, ECC) solves distribution and enables signatures but is slow, so it typically wraps keys. Hashing (SHA-256) provides integrity, not confidentiality; a salt defeats rainbow tables, a pepper is a separate secret. Digital signatures give integrity, authenticity and non-repudiation - not confidentiality. Encoding (Base64) is not encryption.
Traps
Mixing Bell-LaPadula and Biba directions; claiming encryption prevents availability attacks; calling hashing "encryption"; assuming TLS protects data at rest.
Worked example
A designer proposes hiding the admin URL as the only control. That violates open design and fail-safe defaults; replace it with authentication, authorization and logging, and treat the obscure URL as defense in depth at most.