I85PREP
⌘ K
GISP study materials
GISP study resources

GISP: Security Architecture and Engineering: Models, Cryptography, and Trusted Components

GISP · Work through your exam, one topic at a time.

All guide sections

Security Architecture and Engineering: Models, Cryptography, and Trusted Components

What this domain tests

Domain 3 checks whether you can select a security model that matches the requirement, reason about where trust is anchored in a system, and apply cryptography correctly. Expect questions on formal models, the trusted computing base, virtualization and cloud boundaries, key management, and physical and environmental controls.

Core rules

  • Bell-LaPadula protects confidentiality: no read up (simple security property) and no write down (star property). Biba reverses it for integrity: no read down, no write up. Clark-Wilson enforces integrity through well-formed transactions, separation of duties, and certification of transformation procedures. Brewer-Nash implements a Chinese Wall against conflicts of interest.
  • A reference monitor must be tamperproof, always invoked, and verifiable. The trusted computing base is the totality of protection mechanisms, and smaller is better. Protection rings place the most privileged operations closest to the hardware.
  • Symmetric cryptography (AES) is fast but has a key-distribution problem. Asymmetric cryptography (RSA, ECC) solves distribution and enables signatures but is slow, so hybrids are used. Hashing (SHA-256, SHA-3) provides integrity, not confidentiality; HMAC adds a shared key for authenticity.
  • A digital signature is produced with the signer's private key and verified with the public key, giving integrity, origin authentication, and non-repudiation. Encryption to a recipient uses the recipient's public key.
  • PKI trust flows from a root through intermediates to leaf certificates; revocation is published via CRL or OCSP. Key management spans generation, distribution, storage, rotation, and destruction.
  • Physical controls include layered perimeter defense, fire detection and clean-agent suppression, HVAC with positive pressure, EMI shielding, and UPS plus generator for power.

Worked example

A commercial accounting system needs integrity guarantees and separation of duties among clerks and approvers. Bell-LaPadula is the wrong fit because it addresses confidentiality labels. Biba is closer but too coarse for business rules. Clark-Wilson fits: constrained data items, well-formed transactions that preserve invariants, and certification that no single clerk can both enter and approve a payment. The reasoning is requirement-driven: confidentiality model for secrecy, integrity model for trustworthy state change, and business separation where the model cannot express it.

Traps that cost marks

  • Describing hashing as a way to keep data confidential.
  • Claiming a signature is created with the public key, or that encryption with a private key provides confidentiality.
  • Treating Common Criteria EAL as a feature list; EAL measures assurance depth, not capability.
  • Assuming TLS gives non-repudiation to the application layer.
  • Overlooking hypervisor and management-plane access in cloud shared-responsibility answers.