3.0 Security Architecture

Security Architecture focuses on designing, implementing, and maintaining secure enterprise infrastructure. This section covers security models, network infrastructure, resilience strategies, and embedded systems security.

Important

This section represents approximately 18% of the Security+ exam and covers critical concepts for designing secure network architectures.

What You'll Learn

Study Tip

Focus on understanding how different architectural components work together to create defense in depth. Many questions will test your ability to select appropriate security controls for specific scenarios.

3.1 Security Architecture Models

Security architecture models provide frameworks for designing and implementing secure systems. Understanding these models is essential for creating effective security controls.

Common Security Models

Model Description Key Principle Use Case
Zero Trust Never trust, always verify; assumes breach Verify explicitly, least privilege Modern networks, cloud environments
Defense in Depth Layered security controls Multiple protection layers Enterprise networks, critical systems
Trust but Verify Traditional perimeter-based security Trust internal, verify external Legacy networks, simple environments
Bell-LaPadula Multi-level security for confidentiality No read up, no write down Military, government systems
Biba Integrity-focused security model No write up, no read down Financial systems, data integrity

Zero Trust Architecture Components

Cloud Security Models

Exam Tip

Be prepared to identify which security model is most appropriate for given scenarios. Zero Trust is heavily emphasized in the current exam objectives.

3.2 Secure Infrastructure

Secure infrastructure involves designing and implementing network architectures with built-in security controls to protect against threats and ensure proper segmentation.

Network Segmentation & Zoning

Zone Purpose Security Level Examples
Public Zone Internet-facing services Low Web servers, DNS servers
DMZ Semi-trusted services Medium Email relays, proxy servers
Private Zone Internal corporate network High Workstations, file servers
Management Zone Network administration Very High Administrative workstations, jump servers
Restricted Zone Sensitive data and systems Highest Databases, financial systems

Network Security Controls

Secure Protocols & Services

💡 Design Principle

Always follow the principle of least privilege when designing network segmentation. Users and systems should only have access to the resources they absolutely need.

3.3 Resilience & High Availability

Resilience ensures that systems can withstand and recover from failures, attacks, or disasters. High availability designs minimize downtime and ensure continuous operation.

High Availability Concepts

Concept Description Implementation
Fault Tolerance System continues operating despite component failures RAID, redundant power supplies, clustered systems
Load Balancing Distributes workload across multiple systems Load balancers, DNS round-robin, cloud scaling
Failover Automatic switching to backup systems Database replication, hot/warm/cold sites
Redundancy Duplicate critical components Multiple internet connections, backup generators

Disaster Recovery Planning

Backup Strategies

Recovery Sites

Testing is Critical

Regular testing of backup and recovery procedures is essential. Many organizations discover their backups are incomplete or corrupted only during actual recovery attempts.

3.4 Embedded Systems & IoT Security

Embedded systems and Internet of Things (IoT) devices present unique security challenges due to their specialized nature, limited resources, and widespread deployment.

Embedded System Categories

Category Examples Security Concerns
IoT Devices Smart home devices, wearables Weak authentication, unencrypted communication
SCADA/ICS Industrial control systems Legacy protocols, air-gap assumptions
Medical Devices Pacemakers, insulin pumps Life-safety implications, FDA regulations
Vehicles Automotive systems, aircraft CAN bus vulnerabilities, remote access
Building Automation HVAC, access control, lighting Physical security implications

Common Embedded System Vulnerabilities

Security Controls for Embedded Systems

Operational Technology (OT) Security

Special considerations for industrial control systems:

Exam Tip

Be familiar with the unique security challenges of embedded systems and IoT devices. Questions often focus on segmentation, default credentials, and the inability to apply patches.

💡 Emerging Trend

The convergence of IT and OT networks is creating new security challenges. Understanding both domains is increasingly important for security professionals.