Security+ · Domain 3
Security Architecture
About 18% of the exam
Architecture models
- On premises
- you own and patch everything
- IaaS
- you own operating system upward
- PaaS
- you own code and data
- SaaS
- you own data and access
- Serverless
- provider runs the execution environment
- Microservices
- small services, more east-west traffic
- Containers
- share the host kernel
- Virtualization
- hypervisor separates the guests
Shared responsibility
- Always the customer
- data, identities and access
- Always the provider
- facility, hardware and hypervisor
- Shifts by model
- operating system and runtime patching
- Responsibility matrix
- written split, agreed before signing
- Third-party vendors
- audit them, never assume
- Hybrid
- two estates, one policy set
Whatever the model, the customer keeps the data and the identities; only the layers below move
What a design has to weigh
Availability and resilience
- Availability targets drive redundancy
- Resilience is recovery, not uptime
- Ease of recovery beats clever design
- Remove single points of failure
Cost and effort
- Cost to build and to run
- Ease of deployment and repeatability
- Patch availability from the vendor
- Inability to patch forces compensating controls
Constraints
- Power and compute budgets
- Scalability up and out
- Responsiveness under peak load
- Risk transference by contract or insurance
Firewalls, proxies and sensors
Firewall types
- Layer 4 filters addresses and ports
- Layer 7 inspects the application
- Next generation adds identity and inspection
- UTM bundles many functions in one
- WAF protects web applications specifically
Placement and mode
- Inline can block, a tap only observes
- Active devices act, passive devices watch
- Screened subnet hosts public services
- Jump server is the only door in
- Fail-open passes traffic, fail-closed stops it
Other appliances
- Forward proxy for outbound users
- Reverse proxy fronts internal servers
- Load balancer spreads and health checks
- IDS alerts, IPS blocks inline
Security devices normally fail closed; safety and life-support systems fail open
Placement and zones
- Put controls where traffic must pass
- Define zones by trust level
- Screened subnet between internet and inside
- Shrink attack surface before adding sensors
- Microsegmentation controls east-west traffic
- Physical separation beats logical separation
- Air gap only if truly disconnected
Secure communication
- IPSec
- layer 3 tunnel, site to site
- Tunnel mode
- whole packet wrapped and encrypted
- Transport mode
- payload encrypted, headers remain
- TLS VPN
- browser friendly remote access
- Split tunnel
- only corporate traffic is tunneled
- Full tunnel
- everything routes through the office
- SD-WAN
- policy driven links between sites
- SASE
- SD-WAN plus cloud delivered security
Data types and classification
- Regulated
- law or standard dictates handling
- Trade secret
- value depends on staying secret
- Intellectual property
- designs, patents, source code
- Legal information
- contracts and case material
- Financial information
- accounts, payments, card data
- Human readable
- a person can read it
- Non-human readable
- binary or encoded records
- Classification levels
- public, private, sensitive, confidential, critical
Data states and protection
- At rest
- stored on disk or media
- In transit
- moving across a network
- In use
- decrypted in memory
- Sovereignty
- law of the hosting country
- Geolocation
- where the copy physically sits
- Geographic restrictions
- block access from other regions
- Masking, tokenization
- cut exposure without full encryption
- Permission restrictions
- who may open the record
Encryption at rest and in transit is routine; data in use needs an enclave or homomorphic processing
High availability
- Load balancing spreads live traffic
- Clustering fails over to another node
- Active-active uses both sites
- Active-passive keeps a standby
- Platform diversity limits a shared flaw
- Multi-cloud survives one provider outage
- Capacity planning covers people and technology
Recovery sites
- Hot site
- running, current data, minutes
- Warm site
- hardware ready, data is stale
- Cold site
- space and power only
- Mobile site
- trailer driven to the location
- Geographic dispersion
- far enough for regional events
- Continuity of operations
- the manual workaround plan
Testing, least to most rigorous
- Read-through
- Tabletop
- Walkthrough
- Simulation
- Parallel processing
- Full interruption
- Least disruptive first, riskiest last
- Parallel runs both sites together
- Full interruption really stops production
- Findings must update the plan
The riskiest test is the full interruption test, and it needs executive sign off
Backups and power
- Three copies, two media, one offsite
- Full, incremental, differential, snapshot
- Incremental restore needs the whole chain
- Differential needs full plus latest differential
- Immutable copies survive ransomware
- Encrypt backups and test restores
- UPS bridges the gap to generator
- Generators need fuel and load testing
IoT, ICS and embedded
- SCADA
- supervises distributed industrial processes
- ICS
- controls plant and machinery
- PLC
- runs the direct control logic
- RTOS
- deterministic timing, hard to patch
- Embedded
- fixed function, long service life
- IoT
- weak defaults, rarely updated
- Data diode
- hardware enforced one-way flow
- OT priority
- safety and availability come first
Ports worth knowing
- FTP
- 20 data, 21 control
- SSH, SFTP, SCP
- all ride port 22
- Telnet
- 23, plaintext, replace with SSH
- SMTP
- 25, submission on 587
- DNS
- 53 UDP and TCP
- HTTP, HTTPS
- 80 and 443
- Kerberos
- 88, five minute skew
- LDAP, LDAPS
- 389 and 636
- SNMPv3
- 161 and 162, authenticated
- Syslog
- 514, or 6514 with TLS
- RDP
- 3389, reach through a jump server
- SQL
- 1433 for MSSQL, 3306 MySQL
Reference strip: models, devices, data, resilience
Models
- IaaS, PaaS, SaaS, serverless
- Hybrid and multi-cloud estates
- Containers, microservices, virtualization
- Infrastructure as code and immutable builds
Devices
- NGFW, UTM, WAF, proxy
- IDS, IPS, load balancer, sensor
- Jump server and bastion host
- Data diode for one-way transfer
Data
- At rest, in transit, in use
- Sovereignty, residency, geographic restriction
- Encryption, hashing, masking, tokenization
- Classification drives the control set
Resilience
- Hot, warm, cold and mobile sites
- Active-active versus active-passive
- Replication, journaling, snapshots
- UPS, generator, dual power feeds
Testing
- Read-through, tabletop, walkthrough
- Simulation, parallel, full interruption
- Failover test proves the design
- Restore test proves the backup
Quick exam traps
- Trap: With IaaS the provider patches your operating system
- Trap: A screened subnet removes the need for internal segmentation
- Trap: An IDS on a tap port will block the attack
- Trap: Split tunneling protects all remote worker traffic
- Trap: Snapshots on the same array count as backups
- Trap: Restoring from incrementals needs only the newest one
- Trap: Confidentiality is the top priority on an OT network
- Trap: Full interruption testing is the safe place to start
cybercertprep.com · original revision sheet written from the public body of knowledge