CISSP Central

3.6 Select and determine cryptographic solutions

• 3.6.1 Cryptographic life cycle
• 3.6.2 Cryptographic methods
• 3.6.3 Public key infrastructure
• 3.6.4 Key Management practices
• 3.6.5 Digital Signatures and Digital Certificates

3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

• 3.5.1 Client-based systems
• 3.5.2 Server-based systems
• 3.5.3 Database systems
• 3.5.4 Cryptographic Systems
• 3.5.5 Operational Technology / Industrial Control Systems (ICS)
• 3.5.6 Cloud-based Systems
• 3.5.7 Distributed Systems
• 3.5.8 Internet of Things (IOT)
• 3.5.9 Microservices
• 3.5.10 Containerization
• 3.5.11 Serverless Computing
• 3.5.12 Embedded systems
• 3.5.13 High-Performance Computing systems
• 3.5.14 Edge Computing Systems
• 3.5.15 Virtualized systems

3.4 Understand security capabilities of Information Systems (IS) (e.g., memory protection,

Trusted Platform Module (TPM), encryption/decryption)

3.3 Select controls based upon systems security requirements

Here we will go over the steps to take when deciding the security controls to deploy according to the needs of the system. Some of these needs were covered in Domain 1's discussion.

3.2 Understand the fundamental concepts of security models

• 3.2.1 Security Models
• 3.2.2 Lattice-based models
• 3.2.3 Rule-based models
• 3.2.4 Other models & Concepts
• 3.2.5 Evaluation Criteria (ITSEC, TCSEC and CC)

3.0 DOMAIN 3: SECURITY ARCHITECTURE AND ENGINEERING

3.1 Research, implement, and manage engineering processes using secure design principles.

• 3.1.1 Threat Modeling
• 3.1.2 Least Privilege
• 3.1.3 Defense in depth
• 3.1.4 Secure Defaults
• 3.1.5 Fail Securely
• 3.1.6 Separation of Duties
• 3.1.7 Keep it simple and Small
• 3.1.8 Zero trust or trust but verify
• 3.1.9 Privacy by design (PbD)
• 3.1.10 Shared Responsibility
• 3.1.11 Secure Access Service Edge

2.5 Ensure appropriate asset retention

2.6 Determine data security controls & compliance requirements

• 2.6.1 Data States
• 2.6.2 Scoping and Tailoring (NIST SP 800-53B)
• 2.6.3 Standards Selection
• 2.6.4 Data Protection methods

2.4 Manage Data Lifecycle

• 2.4.1 Data Roles
• 2.4.2 Data Collection
• 2.4.3 Data Location
• 2.4.4 Data Maintenance
• 2.4.5 Data Retention
• 2.4.6 Data Remanence
• 2.4.7 Data Destruction

2.3 Provision information and assets securely

• 2.3.1 Information and asset ownership
• 2.3.2 Asset inventory
• 2.3.2 Asset Management

2.2 Establish information and asset handling requirements

• 2.2.1 Information and Asset Handling:
• 2.2.2 Handling Requirements:
• 2.2.3 Media Storage:
• 2.2.4 Transportation:
• 2.2.5 Transmission & Transfer:
• 2.2.6 Media retention and destruction: