Security Architecture focuses on designing, implementing, and maintaining secure enterprise infrastructure. This section covers security models, network infrastructure, resilience strategies, and embedded systems security.
Important
This section represents approximately 18% of the Security+ exam and covers critical concepts for designing secure network architectures.
What You'll Learn
🏛️ Security Architecture Models - Frameworks and design principles
🌐 Secure Network Infrastructure - Segmentation, zoning, and secure protocols
🛡️ Resilience & High Availability - Redundancy, fault tolerance, and recovery
🔌 Embedded Systems & IoT - Specialized security for connected devices
☁️ Cloud & Virtualization - Security considerations for modern infrastructure
Study Tip
Focus on understanding how different architectural components work together to create defense in depth. Many questions will test your ability to select appropriate security controls for specific scenarios.
3.1 Security Architecture Models
Security architecture models provide frameworks for designing and implementing secure systems. Understanding these models is essential for creating effective security controls.
Hybrid Cloud: Combination of public and private clouds
Community Cloud: Shared by several organizations with common concerns
Exam Tip
Be prepared to identify which security model is most appropriate for given scenarios. Zero Trust is heavily emphasized in the current exam objectives.
3.2 Secure Infrastructure
Secure infrastructure involves designing and implementing network architectures with built-in security controls to protect against threats and ensure proper segmentation.
Network Segmentation & Zoning
Zone
Purpose
Security Level
Examples
Public Zone
Internet-facing services
Low
Web servers, DNS servers
DMZ
Semi-trusted services
Medium
Email relays, proxy servers
Private Zone
Internal corporate network
High
Workstations, file servers
Management Zone
Network administration
Very High
Administrative workstations, jump servers
Restricted Zone
Sensitive data and systems
Highest
Databases, financial systems
Network Security Controls
Firewalls:
Stateless: Simple packet filtering based on headers
Web Application (WAF): Protects web applications from attacks
Network Access Control (NAC):
802.1X authentication for network access
Device health checking and compliance
Guest network isolation
Virtual Private Networks (VPNs):
Site-to-Site: Connects entire networks
Remote Access: Connects individual users
SSL/TLS VPN: Web-based remote access
IPSec: Network layer encryption
Secure Protocols & Services
DNS Security: DNSSEC for authenticity, DNS over HTTPS/TLS for privacy
Email Security: SPF, DKIM, DMARC for email authentication
Secure File Transfer: SFTP, FTPS, SCP instead of plain FTP
Network Monitoring: NetFlow, sFlow for traffic analysis
Wireless Security: WPA3, 802.1X, EAP-TLS for secure Wi-Fi
💡 Design Principle
Always follow the principle of least privilege when designing network segmentation. Users and systems should only have access to the resources they absolutely need.
3.3 Resilience & High Availability
Resilience ensures that systems can withstand and recover from failures, attacks, or disasters. High availability designs minimize downtime and ensure continuous operation.
High Availability Concepts
Concept
Description
Implementation
Fault Tolerance
System continues operating despite component failures
RAID, redundant power supplies, clustered systems
Load Balancing
Distributes workload across multiple systems
Load balancers, DNS round-robin, cloud scaling
Failover
Automatic switching to backup systems
Database replication, hot/warm/cold sites
Redundancy
Duplicate critical components
Multiple internet connections, backup generators
Disaster Recovery Planning
Recovery Time Objective (RTO): Maximum acceptable downtime
Recovery Point Objective (RPO): Maximum acceptable data loss
Business Impact Analysis (BIA): Identifies critical systems and processes
Backup Strategies
Full Backup: Complete copy of all data
Pros: Fastest restore, complete recovery
Cons: Slow backup, high storage requirements
Incremental Backup: Only changed data since last backup
Pros: Fast backup, efficient storage
Cons: Slower restore, requires all increments
Differential Backup: Changed data since last full backup
Pros: Faster restore than incremental
Cons: Larger backup size than incremental
3-2-1 Backup Rule:
3 copies of data
2 different media types
1 copy offsite
Recovery Sites
Hot Site: Fully operational, ready immediately
Cost: High
Recovery Time: Minutes to hours
Warm Site: Partially configured, requires setup
Cost: Medium
Recovery Time: Hours to days
Cold Site: Basic infrastructure only
Cost: Low
Recovery Time: Days to weeks
Testing is Critical
Regular testing of backup and recovery procedures is essential. Many organizations discover their backups are incomplete or corrupted only during actual recovery attempts.
3.4 Embedded Systems & IoT Security
Embedded systems and Internet of Things (IoT) devices present unique security challenges due to their specialized nature, limited resources, and widespread deployment.
Embedded System Categories
Category
Examples
Security Concerns
IoT Devices
Smart home devices, wearables
Weak authentication, unencrypted communication
SCADA/ICS
Industrial control systems
Legacy protocols, air-gap assumptions
Medical Devices
Pacemakers, insulin pumps
Life-safety implications, FDA regulations
Vehicles
Automotive systems, aircraft
CAN bus vulnerabilities, remote access
Building Automation
HVAC, access control, lighting
Physical security implications
Common Embedded System Vulnerabilities
Default Credentials: Many devices ship with well-known default passwords
Lack of Update Mechanisms: No way to patch discovered vulnerabilities
Insecure Communication: Unencrypted data transmission
Hardware Backdoors: Undocumented access methods
Resource Constraints: Limited processing power prevents strong encryption
Physical Access: Devices often deployed in unsecured locations
Security Controls for Embedded Systems
Network Segmentation: Isolate embedded systems on separate VLANs
Access Control: Change default credentials, implement least privilege
Monitoring: Specialized monitoring for unusual device behavior
Supply Chain Security: Verify device integrity before deployment
Lifecycle Management: Plan for device replacement and disposal
Operational Technology (OT) Security
Special considerations for industrial control systems:
Safety First: Security measures must not compromise safety systems
Availability Critical: Downtime can cause physical damage or production loss
Legacy Systems: Many systems cannot be easily updated or replaced
Air Gap Limitations: Assumed air gaps often don't exist in practice
Protocol Security: Industrial protocols (Modbus, DNP3) lack security features
Exam Tip
Be familiar with the unique security challenges of embedded systems and IoT devices. Questions often focus on segmentation, default credentials, and the inability to apply patches.
💡 Emerging Trend
The convergence of IT and OT networks is creating new security challenges. Understanding both domains is increasingly important for security professionals.