Domain 3, Security Architecture and Engineering, is the domain many CISSP candidates find hardest. It mixes design principles, formal security models, system components, cryptography and even physical security. This CISSP Domain 3 cheat sheet condenses the concepts you must know into tables and short explanations you can review in under an hour.
In the current ISC2 outline, Domain 3 carries about 13% of the exam. Always check the official ISC2 outline before your exam date, because weights and wording are updated from time to time.
1. Secure design principles
| Principle | What it means |
|---|---|
| Least privilege | Give users and processes only the access they need, for only as long as they need it. |
| Defense in depth | Layer independent controls so one failure does not expose the asset. |
| Secure defaults | Systems ship in their most secure configuration; features are enabled deliberately. |
| Fail securely | On failure, the system denies access (fail closed) rather than allowing it. |
| Separation of duties | No single person can complete a critical task alone. |
| Keep it simple | Less complexity means fewer flaws and an easier security review. |
| Zero Trust | Never trust by network location; verify every request explicitly. |
| Privacy by design | Build privacy into systems from the start, not as an add-on. |
| Trust but verify | Grant access, but monitor and audit its use. |
| Shared responsibility | In the cloud, security duties are split between the provider and the customer. |
2. Security models
| Model | Protects | Key rules |
|---|---|---|
| Bell-LaPadula | Confidentiality | Simple security: no read up. *-property: no write down. Strong star: read/write only at your own level. |
| Biba | Integrity | Simple integrity: no read down. *-integrity: no write up. |
| Clark-Wilson | Integrity | Access to data only through well-formed transactions (programs); uses separation of duties and the access triple (subject–program–object). |
| Brewer-Nash (Chinese Wall) | Conflicts of interest | Access rights change dynamically based on what a user has already accessed. |
| Graham-Denning | Access rights | Defines rules for securely creating and deleting subjects and objects and granting rights. |
| Take-Grant | Access rights | Uses a directed graph to show how rights can be passed between subjects. |
Memory trick: Bell-LaPadula is about secrets (“no read up”), Biba is about bad data (“no read down”). The rules are exact opposites.
3. Evaluation and certification
- Common Criteria (ISO/IEC 15408): products are evaluated against a Protection Profile (the requirements) and a Security Target (the vendor’s claims). Assurance is rated from EAL1 (functionally tested) to EAL7 (formally verified design and tested).
- Certification is the technical evaluation of a system; accreditation is management’s formal decision to accept the risk and operate it.
4. System components you must know
| Component | Purpose |
|---|---|
| Trusted Computing Base (TCB) | All hardware, firmware and software that enforce the security policy. |
| Reference monitor | Abstract concept that mediates every access; must be tamper-proof, always invoked and small enough to verify. |
| Security kernel | The implementation of the reference monitor inside the TCB. |
| TPM | Chip on the motherboard that stores keys and measures boot integrity. |
| HSM | Dedicated, tamper-resistant device for generating and protecting keys at scale. |
| Protection rings | Ring 0 (kernel) is the most privileged; user applications run in ring 3. |
5. Vulnerabilities by system type
- Cloud: misconfiguration, weak identity management and unclear shared responsibility.
- Virtualization: VM escape, VM sprawl and insecure hypervisors.
- IoT and embedded systems: default passwords, no patching, weak or no encryption.
- ICS/SCADA: legacy protocols without authentication; availability matters most.
- Client-side and server-side: applets, plug-ins, input validation, and database inference and aggregation attacks.
6. Cryptography at a glance
| Type | Examples | Used for |
|---|---|---|
| Symmetric (one shared key) | AES (128/192/256-bit), 3DES, Blowfish, Twofish, RC4 | Fast bulk encryption |
| Asymmetric (key pair) | RSA, ECC, Diffie-Hellman, ElGamal | Key exchange, digital signatures |
| Hashing (one-way) | SHA-2, SHA-3; MD5 and SHA-1 are broken | Integrity, password storage (with salt) |
Keys to remember
- Number of keys: symmetric needs n(n−1)/2 keys for n users; asymmetric needs 2n.
- Confidentiality: encrypt with the recipient’s public key. Digital signature: sign with the sender’s private key.
- Digital signatures provide integrity, authentication and non-repudiation, but not confidentiality.
- Block cipher modes: ECB is insecure (identical blocks give identical output); CBC, CTR and GCM are preferred, and GCM also provides integrity.
- PKI: the CA issues certificates, the RA verifies identity, and revocation is checked with CRLs or OCSP.
Cryptanalytic attacks
- Brute force: tries every key; defeated by longer keys.
- Known plaintext / chosen plaintext / ciphertext-only: classified by what the attacker has.
- Birthday attack: finds hash collisions; the defence is longer hash output.
- Side-channel: timing, power or emanation analysis (TEMPEST shielding helps).
- Rainbow tables: precomputed hashes; defeated by salting.
7. Physical security and site design
- CPTED (Crime Prevention Through Environmental Design): natural surveillance, natural access control and territorial reinforcement.
- Data centre location: avoid basements and top floors, away from flood zones; keep humidity around 40–60%.
- Power issues: blackout (total loss), brownout (prolonged low voltage), sag (brief low voltage), spike and surge (high voltage). Use UPS units and generators.
- Fire classes (US): A = common combustibles, B = liquids, C = electrical, D = metals, K = cooking oils. Water-based sprinklers: dry pipe and pre-action are best near IT equipment.
8. Exam tips for Domain 3
- When asked for the best control, choose the one that addresses the root cause and fits the principle of least privilege.
- Know which model protects confidentiality (Bell-LaPadula) and which protects integrity (Biba, Clark-Wilson).
- Safety of people always comes first, before protecting equipment or data.
Frequently Asked Questions
Is Domain 3 the hardest CISSP domain?
For many candidates, yes, because it combines cryptography and formal models. Use this cheat sheet for repeated short reviews rather than one long session.
How much cryptography do I need for the CISSP?
You need to understand concepts and use cases (which algorithm or key to use and why), not the mathematics behind them.
Where can I study the other domains?
Start with the CISSP Cheat Sheet Series PDF, which covers all 8 domains, then go deeper with the free CISSP Study Guide PDF.
More free CISSP resources
- CISSP Cheat Sheet Series (PDF)
- CISSP Study Guide PDF
- CISSP Concepts Guide PDF
- CISSP Exam Preparation PDF
- CISSP Security Assessment and Testing PDF
