Security Architecture & Design Flashcards

What is the primary goal of security architecture?

Answer: To protect data and system integrity

The primary goal of security architecture is to design and implement systems that effectively protect an organization's assets. This involves safeguarding data from unauthorized access, modification, or destruction, and ensuring the integrity and availability of system resources. Robust security architecture aims to minimize risks and maintain trust in the system's operations.

Which model is commonly used in security design?

Answer: CIA

The CIA triad, standing for Confidentiality, Integrity, and Availability, is a foundational model in information security design. Confidentiality ensures data is accessible only to authorized users, Integrity ensures data is accurate and unaltered, and Availability ensures systems and data are accessible when needed. These three principles guide the development of secure systems and policies.

What is defense in depth?

Answer: Multiple overlapping security mechanisms

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls to protect assets. Instead of relying on a single point of defense, it assumes that any single security mechanism might fail, so having redundant and diverse controls makes it much harder for an attacker to breach the system. This layered approach provides comprehensive protection.

Which is NOT a principle of secure design?

Answer: Complexity over clarity

The principle of 'economy of mechanism' in secure design advocates for simplicity and clarity, meaning systems should be as simple as possible to understand and verify. Complexity often introduces hidden flaws and makes it harder to identify vulnerabilities, increasing the attack surface. Therefore, preferring complexity over clarity directly contradicts a core principle of secure design.

Why is network segmentation important?

Answer: To isolate and control traffic between different zones

Network segmentation divides a network into smaller, isolated segments, each with its own security policies. This practice limits the lateral movement of attackers within the network, as a breach in one segment does not automatically compromise the entire network. It enhances security by allowing granular control over traffic flow and reducing the attack surface.

What does a DMZ in network architecture do?

Answer: Hosts public-facing services securely

A Demilitarized Zone (DMZ) is a perimeter network that sits between an organization's internal network and an external network, typically the internet. Its purpose is to host public-facing services like web servers or email servers, isolating them from the internal network. This design protects the internal network by ensuring that even if a DMZ server is compromised, the core internal systems remain secure.

Which concept refers to allowing only necessary access?

Answer: Least privilege

The principle of least privilege dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their intended functions. This minimizes the potential damage if an account or system is compromised, as the attacker's access will be severely limited. It's a fundamental concept for reducing the attack surface and improving security.

What is a honeypot in network security design?

Answer: A decoy system to detect intrusion

A honeypot is a security mechanism designed to attract, trap, and study cyber attackers. It mimics a legitimate system or network resource but contains no real valuable data, serving as a decoy. By observing how attackers interact with the honeypot, organizations can gather intelligence on attack methods and improve their actual defenses without risking real assets.

Which architecture model isolates each application in its own container?

Answer: Container-based architecture

Container-based architecture, utilizing technologies like Docker, isolates each application and its dependencies within its own lightweight, portable container. This provides a consistent environment for applications, enhances security by isolating processes, and simplifies deployment and scaling. Unlike virtual machines, containers share the host OS kernel, making them more efficient.