CISSP Resources · Domain 3 — 13% of the exam

CISSP Domain 3 Guide: Security Architecture and Engineering

Domain 3 is 13% of the exam and the heaviest technical block. It spans secure design principles, formal security models, cryptography, and physical security — and it is where most candidates lose the most marks.

What Domain 3 covers

Secure design principles: least privilege, defence in depth, fail secure, separation of duties, zero trust
Security models and evaluation criteria
Architecture of systems: client-server, embedded, industrial control, cloud, virtualisation, containers
Cryptography: symmetric, asymmetric, hashing, PKI, key management
Cryptanalytic attacks
Site and facility design, and physical security controls

Security models you must recognise

Model	Protects	Rules
Bell-LaPadula	Confidentiality	No read up, no write down
Biba	Integrity	No read down, no write up
Clark-Wilson	Integrity	Well-formed transactions, separation of duties
Brewer-Nash (Chinese Wall)	Conflict of interest	Access changes dynamically based on prior access
Graham-Denning / HRU	Rights management	Rules for creating and deleting subjects and objects

The one-line memory hook

Bell-LaPadula keeps secrets (confidentiality). Biba keeps things clean (integrity). Their read/write rules are mirror images.

Cryptography essentials

Type	Provides	Examples	Key point
Symmetric	Confidentiality, speed	AES, ChaCha20	One shared key; key distribution is the hard problem
Asymmetric	Key exchange, non-repudiation	RSA, ECC, Diffie-Hellman	Slow; used to protect symmetric keys
Hashing	Integrity	SHA-256, SHA-3	One-way, no key
MAC / HMAC	Integrity plus authenticity	HMAC-SHA256	Shared key; no non-repudiation
Digital signature	Integrity, authenticity, non-repudiation	RSA, ECDSA	Sign with the private key, verify with the public

Encrypt for confidentiality with the recipient's public key; sign for non-repudiation with your private key.
Only asymmetric cryptography provides non-repudiation. A shared key cannot prove who used it.
Key management — generation, distribution, storage, rotation, destruction — matters more than algorithm choice in exam answers.
Perfect forward secrecy means compromising a long-term key does not expose past sessions.

Attacks to recognise

Side channel — timing, power, or emanations rather than the algorithm.
Birthday attack — hash collisions.
Rainbow tables — precomputed hashes; defeated by salting.
Meet-in-the-middle — why 2DES was abandoned.
Downgrade — forcing a weaker protocol version.
Rubber-hose — coercion; a reminder that people are in scope.

Physical security

Deterrence, then denial, then detection, then delay, then response — layered, not either/or.
Fail-safe protects people (doors unlock). Fail-secure protects assets (doors lock). Life safety always wins.
CPTED uses natural surveillance, territorial reinforcement, and access control through design.
Fire suppression: water is safest for people; clean agents for equipment; know the classes of fire.

Study checklist

State the read and write rules for Bell-LaPadula and Biba from memory.
Explain which key is used to encrypt, decrypt, sign and verify.
Name the service each crypto primitive provides — and does not provide.
Distinguish fail-safe from fail-secure and justify by human safety.

Frequently asked questions

Is cryptography heavily tested on the CISSP?

Yes, but conceptually. You need to know which primitive provides which service and how keys are managed — not how to implement algorithms.

What is the difference between Bell-LaPadula and Biba?

Bell-LaPadula protects confidentiality with no-read-up and no-write-down. Biba protects integrity with the mirrored no-read-down and no-write-up rules.

Work through the models and crypto in question form

Domain 3 is best learned by answering, not re-reading. Practise the model and key-usage distinctions until they are automatic.

Start free View pricing

Related guides

More CISSP study material from Domain Eight: browse all resources.