Security Architecture and Design
What this domain tests
Security Architecture and Design tests secure design principles and models: trust boundaries, reference monitor, trusted computing base, defense in depth, fail-safe defaults, separation of duties, least privilege, and mediated access. Expect Bell-LaPadula, Biba, Clark-Wilson, and zoning questions.
Core rules
- Bell-LaPadula protects confidentiality: no read up, no write down. Biba protects integrity: no read down, no write up. Clark-Wilson enforces well-formed transactions and separation of duties.
- A reference monitor must be tamper-proof, always invoked, and small enough to verify; the trusted computing base is the set of components that must be trusted.
- Design in layers: edge, DMZ, application, data, management. Each boundary needs authentication, authorization, logging, and defined failure behavior.
- Fail closed for security decisions, but design availability so a failed component does not cascade.
Worked example
A three-tier application needs internet users, an app tier, and a database. Put a WAF and load balancer at the edge, app tier in a private subnet, database in an isolated subnet. Allow only 443 to the edge, edge to app on the app port, app to database on the database port. Use workload identity, not shared database credentials. If the app tier fails, the edge returns a controlled error; if the database is unreachable, the app fails closed for writes and logs the event. This satisfies mediated access and least privilege at each boundary.
Traps
Mixing Bell-LaPadula and Biba is a common mark-loser. Obscurity is not a boundary. A single firewall between all zones collapses defense in depth. Fail-open for availability can become an authorization bypass.