CISSP Domain 3: Security Architecture and Engineering
A full tour of Domain 3 of the CISSP exam - Security Architecture and Engineering - the second-largest of the eight domains, worth 13% of the exam under ISC2's exam outline effective 15 April 2024.
It closes with a recap tying all nine sub-areas together and showing how they feed the other seven CISSP domains, then fifteen exam-style questions, each with four options, a pause to think, and an explained answer.
Every figure is on screen with its source and date.
Educational documentary. Not financial or investment advice.
In these topics
Chapters
- Welcome, and What This Domain Covers
- Secure Design: Threat Modelling and Least Privilege
- Secure Design: Depth, Defaults and Duties
- Secure Design: Zero Trust, Privacy and SASE
- Security Models: Bell-LaPadula and Biba
- Security Models: Clark-Wilson, Brewer-Nash, Take-Grant
- Selecting Controls and Evaluation Criteria
- Security Capabilities of Information Systems
- Vulnerabilities: Client, Server and Database
- Vulnerabilities: Industrial Control Systems
- Vulnerabilities: Cloud and Distributed Systems
- Vulnerabilities: IoT, Containers and Edge
- Cryptographic Solutions: The Crypto Lifecycle and Algorithms
- Cryptographic Solutions: PKI, Signatures and Key Management
- Cryptanalytic Attacks: Brute Force and Plaintext Attacks
- Cryptanalytic Attacks: Side-Channel and Credential Attacks
- Security Principles in Site and Facility Design
- Site & Facility Controls: Rooms, Closets & Restricted Areas
- Site and Facility Controls: Utilities, Environment and Power
- Domain Recap, and How It Links to the Other Seven
- Review: Exam-Style Questions, Part One
- Review: Exam-Style Questions, Part Two
- Review: Exam-Style Questions, Part Three
Sources and credits
Photo credits (Wikimedia Commons)
- Trusted Platform Module (TPM) chip on a motherboard: FxJ, Public domain - https://commons.wikimedia.org/wiki/File%3ATPM_Asus.jpg
- Smart card chip (used for PKI tokens and digital certificates): B7342 (talk), Public domain - https://commons.wikimedia.org/wiki/File%3ASmart_card_chip_on_penny.JPG
- Enigma machine, the historical cipher machine broken by frequency analysis and known-plaintext attacks: unknown, Public domain - https://commons.wikimedia.org/wiki/File%3AEnigma_Machine_at_NSA.jpg
- US Navy operator at a SCADA (supervisory control and data acquisition) system console: U.S. Navy photo by Joe Schmitt, Public domain - https://commons.wikimedia.org/wiki/File%3AUS_Navy_110328-N-OJ170-009_Hideji_Kawasaki_operates_the_supervisory_control_and_data_acquisition_%28SCADA%29_system_to_balance_an_electrical_load_insid.jpg
- Server rack with networking equipment and cabling in a data center: Federal Bureau of Investigation, Public domain - https://commons.wikimedia.org/wiki/File%3AEFTA00002518_-_Server_rack_with_multiple_hard_drives_and_network_cables_connected_in_a_data_center_environment.jpg
- UPS power management module and server racks with network cabling in a data center (NERSC): Derrick Coetzee from Berkeley, CA, USA, CC0 - https://commons.wikimedia.org/wiki/File%3AUPS_Power_Management_Module%2C_racks_with_network_cabling_in_NERSC_data_center.jpg
Primary sources
- ISC2, 'CISSP Certification Exam Outline', effective 15 April 2024 (isc2.org) - Domain 3 weight 13%, nine sub-objectives. Re-checked by web search 11 October 2026 (readynez.com, infosectrain.com, destcert.com corroborate the 13% figure and the 2024 outline's new sub-topics: keep it simple and small, zero trust, privacy by design, SASE, expanded OT/ICS and microservices coverage).
- D. Elliott Bell and Leonard J. LaPadula, 'Secure Computer Systems: Mathematical Foundations', MITRE Corporation, 1973 - the Bell-LaPadula confidentiality model.
- Kenneth J. Biba, 1977 - the Biba integrity model. Re-checked by web search 11 October 2026 (en.wikipedia.org/wiki/Biba_Model); corrects an earlier, unverified 1973 guess from scoping.
- David D. Clark and David R. Wilson, 'A Comparison of Commercial and Military Computer Security Policies', IEEE Symposium on Security and Privacy, 1987 - the Clark-Wilson integrity model.
- David F.C. Brewer and Michael J. Nash, 'The Chinese Wall Security Policy', IEEE Symposium on Security and Privacy, 1989 - the Brewer-Nash model.
- Common Criteria history and ISO/IEC 15408: unification work began June 1993, version 2.1 became ISO/IEC 15408 in 1999, current edition ISO/IEC 15408-1:2022; EAL1 (lowest) to EAL7 (highest). Re-checked by web search 11 October 2026 (commoncriteriaportal.org, en.wikipedia.org/wiki/ISO_15408, techtarget.com).
- NIST, Federal Information Processing Standards 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA), finalised 13 August 2024 - the first post-quantum cryptography standards. Re-checked by web search 11 October 2026 (cyberinsider.com, convergedigest.com, hpcwire.com, executivegov.com).
- Symantec, 'W32.Stuxnet Dossier', version 1.4, February 2011, and general accounts of the June 2010 discovery, Siemens PLC targeting and roughly 1,000 replaced centrifuges at Natanz, Iran. Re-checked by web search 11 October 2026 (cyberlaw.ccdcoe.org, britannica.com).
- C. Ray Jeffery, 'Crime Prevention Through Environmental Design', 1971 (coined the CPTED term); Oscar Newman, 'Defensible Space: Crime Prevention through Urban Design', 1972. Re-checked by web search 11 October 2026 (en.wikipedia.org/wiki/Crime_prevention_through_environmental_design).
- Gartner analysts Neil MacDonald and Joe Skorupa coined 'secure access service edge' (SASE) in reports dated 29 July 2019 and 30 August 2019. Re-checked by web search 11 October 2026 (en.wikipedia.org/wiki/Secure_access_service_edge, catonetworks.com).
Not regulated financial advice.