Domain 3 Security Architecture

High Availability - Load Balancing vs. Clustering

Load balancing distributes traffic across multiple active nodes to prevent overload; clustering links multiple servers together to act as a single redundant unit for failover and high availability.

Site Considerations - Hot Site

A fully configured secondary recovery location equipped with redundant hardware, real-time data replication, and software, allowing near-instantaneous failover.

Site Considerations - Cold Site

An empty recovery location equipped with basic power, cooling, and network infrastructure, but requiring hardware setup and data restoration before operational use.

Site Considerations - Warm Site

A partially configured secondary site equipped with hardware and network connections, but requiring final software deployment and recent data backups to become operational.

Site Considerations - Geographic Dispersion

Distributing critical data centers, servers, or personnel across separate physical locations to mitigate regional disasters or localized disruptions.

Platform Diversity

Using a variety of operating systems, hardware platforms, and software vendors to prevent a single targeted exploit or vulnerability from taking down the entire enterprise.

Multi-Cloud Systems

Deploying cloud infrastructure across multiple distinct Cloud Service Providers (CSPs) to avoid vendor lock-in, maximize uptime, and enhance resilience.

Continuity of Operations (COOP)

Planning and operational processes designed to ensure essential business functions continue running during and after a major emergency or disruption.

Capacity Planning - People

Ensuring sufficient, cross-trained staff and key personnel are available to sustain critical operations during disruptions or key employee absences.

Capacity Planning - Technology

Evaluating and projecting processing power, bandwidth, and software capabilities required to handle peak operational loads without performance degradation.

Capacity Planning - Infrastructure

Assessing physical facility space, cooling capacity, server racks, and network cabling to support growth and disaster scenarios.

Testing - Tabletop Exercises

A discussion-based exercise where key stakeholders talk through a simulated emergency scenario to evaluate roles, plans, and procedures without disrupting operations.

Testing - Failover

A hands-on test that deliberately switches operations from primary systems to redundant backup hardware or a secondary site to verify seamless transition.

Testing - Simulation

A practical operational exercise that simulates a realistic disruption in a controlled environment to evaluate technical and personnel responses.

Testing - Parallel Processing

A high-fidelity testing method where backup systems are brought online and run simultaneously alongside primary production systems to validate data sync without affecting operational output.

Backups - Onsite vs. Offsite

Onsite backups provide fast local restores; offsite backups protect data against localized disasters (e.g., fires, flooding) by storing copies at a separate geographical location.

Backups - Frequency

How often data is backed up, directly driving the organization's Recovery Point Objective (RPO).

Backups - Encryption

Applying cryptographic controls to backup sets both at rest and in transit to prevent unauthorized exposure if backup media is stolen or intercepted.

Backups - Snapshots

A point-in-time image or copy of a system state, application, or storage volume, frequently used in virtualized environments for rapid restoration.

Recovery

The process of restoring systems, data, and business operations to normal working conditions following a security incident or infrastructure failure.

Replication

Continuously copying and synchronizing data in real-time or near-real-time between primary and secondary storage systems to minimize data loss.

Journaling

A file system or database technique that logs changes in a transaction log before committing them to main storage, ensuring rapid consistency recovery after abrupt crashes.

Power - Generators

Emergency fuel-powered engines that provide long-term electrical power to critical systems during extended power grid outages.

Power - Uninterruptible Power Supply (UPS)

A battery-backed power system providing immediate, short-term electrical power during outages, allowing clean system shut downs or bridging the gap until generators start.

Data Types - Regulated

Data governed by laws, regulations, or industry standards (e.g., GDPR, HIPAA, PCI DSS) requiring specific security and privacy protections.

Data Types - Trade Secret

Proprietary information, formulas, designs, or practices that provide a competitive business advantage and must be kept strictly confidential.

Data Types - Intellectual Property

Intangible human creations legally protected by copyrights, patents, or trademarks (e.g., source code, proprietary algorithms).

Data Types - Legal Information

Contracts, litigation records, regulatory filings, and communications covered by legal privilege or regulatory retention mandates.

Data Types - Financial Information

Sensitive fiscal data such as corporate earnings reports, accounting ledgers, credit card numbers, and banking details.

Data Types - Human- and Non-Human-Readable

Human-readable data is plain text easily parsed by people; non-human-readable data includes compiled binaries, raw machine logs, and encrypted payloads.

Data Classification - Sensitive

A broad category for data requiring protection from unauthorized access to prevent operational, reputational, or financial harm.

Data Classification - Confidential

High-sensitivity data restricted to authorized personnel with a specific need-to-know, where unauthorized exposure could cause significant damage.

Data Classification - Public

Information freely accessible to anyone with no risk to the organization if disclosed (e.g., marketing brochures, press releases).

Data Classification - Restricted

Highly sensitive data with the most stringent access controls, often limited to specific roles or executive leadership.

Data Classification - Private

Data containing personally identifiable information (PII) or personal health information (PHI) linked to an individual.

Data Classification - Critical

Essential data required for core business functions or mission-critical operations to run without disruption.

Data States - Data at Rest

Static data stored on physical or virtual storage devices (e.g., hard drives, databases, cloud storage buckets).

Data States - Data in Transit

Data actively moving across a network or communications channel (e.g., web traffic, email transmission).

Data States - Data in Use

Data currently loaded into system memory (RAM), CPU registers, or cache being actively processed by an application.

General Data Considerations - Data Sovereignty

The legal requirement that data stored or collected is subject to the laws and governance of the country or jurisdiction where it resides physically.

General Data Considerations - Geolocation

Identifying or tracking the exact physical, geographic location of a device, server, or user storing and processing data.

Methods to Secure Data - Geographic Restrictions

Using geofencing, IP blocking, or location-aware access controls to restrict data access based on physical geography.

Methods to Secure Data - Encryption

Transforming readable plaintext into unreadable ciphertext using a cryptographic algorithm and key to ensure confidentiality.

Methods to Secure Data - Hashing

A one-way cryptographic function converting input data into a unique, fixed-length string to verify data integrity.

Methods to Secure Data - Masking

Hiding sensitive data by replacing characters with placeholders (e.g., hiding all but the last 4 digits of a credit card) while retaining structure.

Methods to Secure Data - Tokenization

Replacing sensitive data with a non-sensitive random surrogate (token) that maps back to the real data via a secure lookup table.

Methods to Secure Data - Obfuscation

Making code or data complex, confusing, or difficult for humans or reverse-engineering tools to understand while retaining its functionality.

Methods to Secure Data - Segmentation

Isolating networks, storage units, or databases to restrict access and limit lateral movement between data stores.

Methods to Secure Data - Permission Restrictions

Applying Access Control Lists (ACLs), Role-Based Access Control (RBAC), and least privilege policies to restrict who can read, modify, or delete data.

Infrastructure Considerations - Device Placement

Positioning security devices strategically across the network to control traffic, enforce policies, and maximize visibility at critical boundary points.

Infrastructure Considerations - Security Zones

Logical or physical divisions within a network (e.g., DMZ, Internal, Guest, Air-Gapped) that segregate assets based on risk level and trust requirements.

Infrastructure Considerations - Attack Surface

The total sum of all exposed vulnerabilities, access points, and open paths that an attacker could exploit to gain unauthorized entry.

Infrastructure Considerations - Connectivity

The physical and logical paths enabling data exchange between devices, requiring strict authorization and transport encryption.

Failure Modes - Fail-Open

A default failure state that allows traffic or physical access to pass when a system or security device fails, prioritizing availability and physical safety over confidentiality/security.

Failure Modes - Fail-Closed

A default failure state that denies all traffic or physical access when a system fails, prioritizing security and access control over system availability.

Device Attribute - Active vs. Passive

Active controls continuously monitor and take automatic action to block or mitigate threats; passive controls only monitor, log, and generate alerts without interrupting traffic flow.

Device Attribute - Inline vs. Tap/Monitor

Inline devices sit directly in the traffic path to inspect and modify/block packets; tap/monitor configurations receive out-of-band copied traffic via SPAN/TAP ports for non-intrusive analysis.

Network Appliances - Jump Server

A hardened intermediate server used by administrators to securely access, manage, and bridge connections into high-security internal network zones.

Network Appliances - Proxy Server

An intermediary device that forwards client requests to external resources, providing anonymity, content filtering, caching, and inbound/outbound inspection.

Network Appliances - IPS vs. IDS

An Intrusion Detection System (IDS) is a passive, out-of-band tool that alerts on suspicious activity; an Intrusion Prevention System (IPS) sits inline to actively detect and block malicious traffic.

Network Appliances - Load Balancer

A network appliance that distributes incoming traffic across multiple servers to optimize performance, prevent overload, and support High Availability (HA).

Network Appliances - Sensors

Hardware or software agents deployed across network segments to capture telemetry, log events, and send security monitoring data to a SIEM or central controller.

Port Security - 802.1X

An IEEE network standard providing port-based Network Access Control (PNAC) to authenticate devices attempting to connect to a LAN or WLAN.

Port Security - Extensible Authentication Protocol (EAP)

An authentication framework used in 802.1X and wireless networks that supports various authentication methods like passwords, tokens, and digital certificates.

Firewall Types - Web Application Firewall (WAF)

A Layer 7 firewall specifically designed to inspect HTTP/HTTPS traffic and protect web applications against web-based attacks like SQL injection and XSS.

Firewall Types - Unified Threat Management (UTM)

An all-in-one security appliance combining multiple features such as firewalling, anti-malware, URL filtering, spam filtering, and IDS/IPS into a single device.

Firewall Types - Next-Generation Firewall (NGFW)

A advanced firewall combining deep packet inspection, application-level inspection, identity-based access controls, and integrated threat intelligence.

Firewall Types - Layer 4 vs. Layer 7

Layer 4 firewalls inspect stateful traffic based on IP addresses and transport ports (TCP/UDP); Layer 7 firewalls inspect the payload and application-layer protocols (HTTP, FTP, DNS).

Secure Access - Virtual Private Network (VPN)

An encrypted tunnel created over a public network (like the internet) to secure remote connections to a private network.

Secure Access - Remote Access

Techniques and protocols allowing users to connect securely to corporate network assets from offsite locations.

Secure Access - Tunneling

Encapsulating one network protocol within another packet payload to transport data securely over incompatible or untrusted networks.

Tunneling Protocols - Transport Layer Security (TLS)

A cryptographic protocol providing end-to-end communication security, encryption, and authentication over TCP networks (commonly used for HTTPS and SSL VPNs).

Tunneling Protocols - Internet Protocol Security (IPSec)

A suite of protocols used to secure IP communications at Layer 3 through network-layer encryption, integrity validation, and authentication (commonly used for Site-to-Site VPNs).

Secure Access - Software-Defined Wide Area Network (SD-WAN)

A software-defined architecture that dynamically routes WAN traffic across multiple transport links (MPLS, LTE, broadband) to optimize network performance and security.

Secure Access - Secure Access Service Edge (SASE)

A cloud-native framework combining WAN capabilities (like SD-WAN) with comprehensive cloud security services (CASB, SWG, ZTNA, FWaaS) into a single unified platform.

Selection of Effective Controls

The process of evaluating security requirements, risk levels, and operational impacts to select technical, managerial, or operational controls that mitigate threats effectively.

Cloud - Responsibility Matrix

A framework defining security tasks split between the Cloud Service Provider (CSP) and customer based on model: SaaS (CSP handles almost all), PaaS (shared OS/data), IaaS (customer handles OS, applications, data).

Cloud - Hybrid Considerations

Security and operational considerations for integrating on-premises environments with cloud resources, requiring unified identity management, continuous data sync, and consistent network security policies.

Cloud - Third-Party Vendors

External contractors, SaaS providers, or MSPs that introduce third-party risk, requiring supply chain management, continuous auditing, and contractual SLAs.

Infrastructure as Code (IaC)

Managing and provisioning infrastructure using machine-readable definition files (e.g., Terraform, Ansible) to ensure consistency, eliminate manual errors, and enable version control.

Serverless

A cloud computing model where application code runs in stateless containers managed dynamically by the provider, removing server management overhead and scaling automatically.

Microservices

An architectural style decomposing applications into small, independent, loosely coupled services communicating via APIs, making updates simpler but increasing API security requirements.

Network Infrastructure - Physical Isolation (Air-Gapped)

A security control where a device or network is physically separated from all external networks and the internet to prevent remote exploitation.

Network Infrastructure - Logical Segmentation

Dividing a physical network into separate virtual segments using software tools like VLANs, subnets, and firewalls to limit lateral movement.

Network Infrastructure - Software-Defined Networking (SDN)

Decoupling the control plane (management logic) from the data plane (packet forwarding) to enable centralized, programmatic control of network policies.

On-Premises

Hardware, servers, and software housed within an organization's physical facilities, providing total control over physical security but requiring high capital investment.

Centralized vs. Decentralized

Centralized architectures process and store data at a core hub for uniform security, while decentralized architecture distributes processing across multiple nodes for fault tolerance.

Containerization

Operating-system-level virtualization where applications run in isolated user spaces (containers) sharing the host OS kernel, offering faster startup and lower resource usage than VMs.

Virtualization

Technology using a hypervisor to create software-based representations of physical hardware, allowing multiple full operating systems (VMs) to run on a single physical host.

Internet of Things (IoT)

Physical devices equipped with sensors, processing power, and software that connect to networks, often presenting patching and hardening challenges.

Industrial Control Systems (ICS) / SCADA

Systems used to control industrial processes and critical infrastructure (e.g., power plants, water systems), prioritizing uptime and availability over standard IT confidentiality.

Real-Time Operating System (RTOS)

An OS designed to process data immediately without buffer delays, critical for time-sensitive systems like automotive brakes and medical devices.

Embedded Systems

Dedicated microcontrollers or processors built into specialized devices (e.g., smart TVs, HVAC, medical tools) that often lack standard security features.

High Availability (HA)

Architectural designs (like redundant hardware, clustering, and load balancing) that minimize system downtime and maintain service availability.

Considerations - Availability

Ensuring systems, data, and applications are continuously operational and accessible to authorized users when needed.

Considerations - Resilience

The capability of an architecture to resist, absorb, adapt to, and recover from security incidents or physical disruptions without full system failure.

Considerations - Cost

Balancing security controls and redundancy against budget limits, licensing costs, operational overhead, and financial risk exposure.

Considerations - Responsiveness

Maintaining acceptable system throughput, response times, and minimal network latency during peak operational workloads.

Considerations - Scalability

The ability of an infrastructure to expand or contract processing capacity seamlessly based on demand (horizontal scaling vs. vertical scaling).

Considerations - Ease of Deployment

How efficiently software updates, security configurations, and infrastructure changes can be deployed safely without disrupting existing services.