CISSP Mastery
All domains
Domain 313% of exam

Security Architecture and Engineering

10 lessons ~6h

0%
0/10

The most technical domain. Secure design principles, formal security models, the security capabilities of systems, architectural vulnerabilities across modern platforms (cloud, IoT, ICS, serverless), cryptography end-to-end, and physical/site security all live here.

Start studying Practice this domain

Recommended reading

Official Study Guide (Sybex) 10eCh. 6–10All-in-One Exam Guide (Harris)Security ArchitectureEleventh Hour CISSPDomain 3

Lessons

  1. 3.1

    Manage engineering processes using secure design principles

    Know each principle and be able to recognize it in a scenario: least privilege, defense in depth, secure defaults, fail securely, separation of duties, zero trust vs trust-but-verify, privacy by design, shared responsibility, and SASE.

    ~40 min

  2. 3.2

    Fundamental concepts of security models

    Map each model to what it protects: Bell-LaPadula (confidentiality: no read up / no write down), Biba (integrity: no write up / no read down), Clark-Wilson (integrity via well-formed transactions), Brewer-Nash (conflict of interest).

    ~45 min

  3. 3.3

    Select controls based upon systems security requirements

    Use evaluation criteria and assurance to select controls. Know Common Criteria (EAL1–7), Target of Evaluation, Protection Profiles, and Security Targets.

    ~30 min

  4. 3.4

    Security capabilities of Information Systems

    Hardware/firmware security primitives: memory protection (rings, isolation), the TPM, HSMs, and hardware-backed encryption/decryption.

    ~30 min

  5. 3.5

    Assess and mitigate vulnerabilities of architectures and designs

    Recognize the characteristic weaknesses of each platform type — from classic client/server and databases to cloud, IoT, ICS/OT, containers, serverless, and edge.

    ~45 min

  6. 3.6

    Select and determine cryptographic solutions

    Core crypto: the lifecycle and key management, symmetric vs asymmetric (and elliptic-curve/quantum), PKI and certificates, digital signatures for integrity + nonrepudiation.

    ~50 min

  7. 3.7

    Methods of cryptanalytic attacks

    Be able to match an attack to its scenario: brute force, ciphertext-only, known/chosen plaintext, frequency analysis, side-channel/timing, MITM, pass-the-hash, Kerberos exploitation, and ransomware.

    ~35 min

  8. 3.8

    Apply security principles to site and facility design

    Apply CPTED (Crime Prevention Through Environmental Design) — natural surveillance, access control, and territorial reinforcement — when designing facilities.

    ~20 min

  9. 3.9

    Design site and facility security controls

    Know controls for sensitive areas and environmental threats: wiring closets, data centers, media/evidence storage, power redundancy, HVAC, and fire detection/suppression classes.

    ~35 min

  10. 3.10

    Manage the information system lifecycle

    Security is embedded across the system lifecycle from requirements through retirement/disposal — verification, validation, and secure decommissioning included.

    ~25 min