CISSP Domain 3 study guide
What Security Architecture and Engineering tests
Domain 3 tests why secure systems behave as intended. You must connect design principles, security models, hardware, cryptography, physical protection, and platform vulnerabilities to an assurance requirement.
Domain 3 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Secure design principles
Apply least privilege, defense in depth, secure defaults, fail securely, zero trust, and related engineering principles.
Security models
Understand how formal models enforce confidentiality, integrity, information flow, and conflict-of-interest rules.
Control selection
Choose controls that satisfy system security and assurance requirements.
Information-system capabilities
Evaluate hardware roots of trust, trusted platforms, distributed systems, and fault tolerance.
Architecture vulnerabilities
Assess web, mobile, embedded, industrial, cloud, container, serverless, IoT, and distributed systems.
Cryptographic solutions
Select and assess encryption, hashing, signatures, certificates, key management, and post-quantum considerations.
Cryptanalytic attacks
Understand attacks against algorithms, implementations, keys, protocols, and side channels.
Site and facility design
Apply secure location, construction, environmental, and layered physical-design principles.
Facility controls
Design and implement physical access, surveillance, fire, power, HVAC, and environmental safeguards.
High-yield distinctions
Bell–LaPadula
Protects confidentiality: no read up and no write down.
Biba
Protects integrity: no read down and no write up.
Hashing
Provides a one-way digest for integrity; it is not encryption.
Digital signature
Provides integrity, origin authentication, and nonrepudiation—not confidentiality.
Symmetric encryption
Efficient bulk encryption using a shared secret.
Asymmetric encryption
Supports key exchange and signatures but is computationally heavier.
Common exam trap
Match the mechanism to the required security service. Encryption does not automatically provide integrity, and a digital signature does not hide the message.
How to study Domain 3
Step 1: Master secure design principles.
Step 2: Compare confidentiality and integrity models.
Step 3: Map cryptographic tools to security services.
Step 4: Study platform-specific vulnerabilities.
Step 5: Finish with facility and environmental controls.