Security Architecture and Design
Security Architecture and Design
This domain tests whether you can translate business and compliance requirements into a defensible Huawei security architecture. Expect questions on security domains, trust boundaries, defense in depth, high availability, and how HiSec components such as HiSecEngine firewalls, HiSec Insight, and HiSec Endpoint fit together.
Core rules
- Segment by trust and function: untrusted internet, DMZ, internal user, data center, and out-of-band management. A firewall or virtual firewall enforces policy at each boundary.
- Default deny between zones; permit only required source, destination, service, and application. Apply least privilege to both users and management planes.
- Design redundancy at every single point: dual firewalls with HRP/VRRP, dual links, dual power, and synchronized policies. Test failover, not just configuration.
- Treat management traffic as its own security domain: separate VLAN, jump host, MFA, and restricted source ranges.
- Map controls to compliance and resilience requirements; avoid adding appliances that cannot be monitored or updated.
Worked example
A retailer needs internet shopping, partner API, and internal ERP. Place the web tier in a DMZ, the API gateway in a second DMZ, and ERP in the internal zone. Allow internet to web tier only on 443; web tier to API only on the API port; API to ERP only from the gateway. Put management on a separate VLAN reachable only through a jump host. Use two firewalls in active/standby with HRP and dual ISP links. Reasoning: each boundary has a distinct trust level, so a compromised web server cannot reach ERP directly; management separation blocks lateral movement from a compromised application.
Traps
Flattening DMZ and internal zones; allowing "any" to make an application work; forgetting return traffic and asymmetric routing in HA designs; and treating a firewall cluster as a substitute for endpoint and identity controls.