SecurityX (CASP+) · Domain 2
Security Architecture
About 27% of the exam
Where components sit
- Reverse proxy
- fronts and shields internal services
- WAF
- inspects HTTP before the application
- API gateway
- authenticates, throttles and routes calls
- Load balancer
- distributes and terminates TLS
- Network IPS
- inline blocking on the segment
- Sensor or tap
- visibility without touching traffic
- Jump server
- brokered administrative access
- Data diode
- hardware enforced one-way flow
Designing for availability
- Clustering
- nodes take over automatically
- Load balancing
- spread with health checking
- Replication
- synchronous or asynchronous copies
- RAID
- disk redundancy, never a backup
- Geographic dispersion
- survives a regional event
- Multi-cloud
- avoids one provider failing
- Cold spare
- hardware waiting to be built
- Quorum
- avoids split brain decisions
Recovery objectives
- RTO
- time until service returns
- RPO
- acceptable window of data loss
- MTTR
- average repair duration
- MTBF
- average interval between failures
- MTD
- the absolute downtime limit
- BCP
- keeps the business functioning
- DRP
- restores the technology
Sites and testing
- Hot site
- current data, minutes to switch
- Warm site
- hardware ready, restore required
- Cold site
- shell facility, weeks away
- Cloud failover
- capacity bought when needed
- Active-active
- both sites carry live traffic
- Test order
- read-through up to full interruption
- Evidence
- test results update the plan
Zero trust architecture
Planes
- Policy engine makes the decision
- Policy administrator issues the session
- Enforcement point applies the decision
- Control plane apart from data plane
Signals
- Identity, device posture, location
- Behavior compared with the baseline
- Sensitivity of the requested resource
- Session risk re-evaluated continuously
Enforcement
- Per resource, never per network
- Least privilege, time-bound where possible
- Microsegmentation between individual workloads
- Log every decision for review
- SASE delivers this from the cloud
Zero trust is an architecture, not a product: the win comes from moving the decision point next to the resource
Cloud and virtualization
Posture
- CSPM finds misconfiguration continuously
- Guard rails block unsafe deployments
- Landing zones set safe defaults
- Infrastructure as code is reviewable
Entitlements
- CIEM finds excessive cloud permissions
- Wildcard actions and resources are findings
- Short lived credentials beat static keys
- Separate accounts separate the blast radius
Workloads
- CWPP covers machines, containers, functions
- Admission control blocks bad manifests
- Serverless: review triggers and permissions
- Immutable deployment removes configuration drift
Segmentation
- Segment by trust and function
- Default deny between segments
- Identity based segmentation follows workloads
- Inspect east-west, not only north-south
- Separate management from production traffic
- Isolate operational technology behind gateways
Identity architecture
- Identity provider
- the authoritative authenticator
- Federation
- trust across organizational boundaries
- Conditional access
- policy evaluated at each request
- Attestation
- the device proves its state
- Single sign-on
- one authentication, many services
- PAM
- vaulting, brokering, session recording
- Just in time
- elevation that expires automatically
- Break-glass
- sealed, alarmed, rarely used
Enterprise PKI
- Offline root
- signs only intermediate certificates
- Issuing CA
- handles day to day issuance
- Certificate policy
- what each certificate may do
- Revocation
- CRL and OCSP with stapling
- Pinning
- binds a service to a key
- Key escrow
- recovery for encryption keys only
- Automation
- short lifetimes demand automated renewal
- Inventory
- know every certificate and expiry
Data protection design
- Classification
- drives every downstream control
- Tokenization
- surrogate value, vault holds original
- Masking
- partial view for lower trust
- Format preserving
- same shape, different value
- DLP
- endpoint, network and cloud coverage
- Envelope encryption
- data key wrapped by master
- HSM
- hardware root for key operations
- Retention
- delete once the purpose ends
Secure systems lifecycle
- Requirements
- Design and threat model
- Build
- Verify
- Deploy
- Operate
- Decommission
- Security requirements written before design
- Threat model tracks the architecture
- Decommission removes data, keys and accounts
- Plan end of life, do not discover it
Software and hardware assurance
- SBOM for every shipped component
- Static and dynamic analysis in pipeline
- Sign artifacts and verify at deployment
- Pin dependencies to known versions
- Source hardware from vetted suppliers
- Verify firmware signatures before installation
Deception and attack surface
- Honeytokens across identity and data
- Decoy services on quiet segments
- Decoy alerts are high fidelity
- Map the external surface continuously
- Retire forgotten domains and endpoints
- Test detection as well as prevention
Rapid recall
- North-south
- traffic entering and leaving
- East-west
- traffic between internal workloads
- Blast radius
- what one compromise can reach
- Landing zone
- the safe default environment
- Guard rail
- prevents an unsafe configuration
- Attestation
- proof of the platform state
- Envelope encryption
- keys wrapping other keys
Reference strip: place, protect, prove, recover
Placement
- Reverse proxy, WAF, API gateway
- Load balancer and network IPS
- Taps, sensors and jump servers
- Data diode for one-way transfer
Zero trust
- Policy engine, administrator, enforcement point
- Continuous evaluation of session risk
- Microsegmentation and least privilege
- SASE and secure web gateways
Cloud
- CSPM, CIEM, CASB, CWPP
- Landing zones and guard rails
- Infrastructure as code review
- Container admission control
Data
- Classification, tokenization, masking
- DLP across endpoint, network, cloud
- Envelope encryption and HSM roots
- Retention and secure deletion
Resilience
- Clustering, replication, quorum
- Hot, warm and cold sites
- RTO, RPO, MTTR, MTBF, MTD
- Failover testing and evidence
Quick exam traps
- Trap: Buying a zero trust product delivers zero trust
- Trap: RAID and replication remove the need for backups
- Trap: A WAF makes input validation unnecessary
- Trap: Microsegmentation only matters for north-south traffic
- Trap: Cloud posture tools also fix excessive permissions
- Trap: An offline root can sign day to day certificates
- Trap: Tokenized data can be reversed without the vault
- Trap: Decommissioning is finished when the server powers off
cybercertprep.com · original revision sheet written from the public body of knowledge