Information Security ยท Chapter 7

Principles of Security
Design, Models & Capabilities

A complete visual study guide covering architecture principles, security models, and CIA techniques.

๐Ÿ”

Security Architecture Principles

9 fundamental rules for designing secure systems

What is Security Architecture?

Security architecture is the overall system required to protect an organization's IT infrastructure โ€” including hardware, software specifications, processes, and procedures involved in preventing, mitigating, and investigating threats. Security Architecture Principles are the fundamental rules that should be applied when designing and implementing security controls.

Principle #1

๐Ÿ—๏ธ Security by Design

Security requirements should be considered from the very start of development โ€” not as an afterthought. Building security in early saves time, money, and effort.

๐Ÿ’ก Tip Think of security as a foundation, not a coat of paint. Adding it later is like installing locks on a glass door.
๐Ÿ“ Exam Watch If a question asks "when should security requirements be addressed?", the answer is during initial design, not after development.
Principle #2

โœ‚๏ธ Simplicity

Reduce complexity in security controls. Simpler systems have fewer mistakes, are easier to manage, and security issues are resolved faster.

๐Ÿ’ก Tip The more complex the system, the more potential for misconfigurations. Choose simple, well-understood controls over complex ones.
๐Ÿ“Œ Example Using a single MFA solution across all systems is simpler than five different authentication methods โ€” and easier to audit.
Principle #3

๐Ÿง… Defense in Depth

Use multiple layers of security. If one control fails or is bypassed, others still protect the system. No single point of failure.

๐Ÿ“Œ Real-World Example An enterprise network uses: perimeter firewall โ†’ IDS โ†’ network segmentation โ†’ secure endpoints โ†’ encryption. If the firewall is bypassed, the IDS and other layers still block the attacker.
๐Ÿ“ Exam Watch "Layered security" = Defense in Depth. Look for answers mentioning multiple controls working together.
Principle #4

๐Ÿ”‘ Least Privilege

Grant only the minimum privileges needed for a user or process to do their job. No more, no less.

๐Ÿ“Œ Example A database admin should only access their assigned databases โ€” not application servers or HR files unrelated to their role. A read-only user should not have write or delete permissions.
๐Ÿ“ Exam Watch Least privilege is the most tested principle. Any scenario about "giving minimum access" maps here.
Principle #5

๐Ÿšซ Default Deny

The default setting is to deny all access. Access must be explicitly granted through configuration. Nothing is allowed unless specifically permitted.

๐Ÿ’ก Tip Think of a bouncer at a club: you're not getting in unless your name is on the list. The list is empty by default.
๐Ÿ“ Exam Watch Also called "Implicit Deny" in firewall/ACL contexts. If no rule matches, access is denied.
Principle #6

๐Ÿ”’ Fail Secure

When a system fails, it should fail in a secure state โ€” blocking access to protect data integrity, even if it causes a denial of service.

ModeResultRisk
Fail SecureAccess blockedDenial of service
Fail SafeControl disabledIllegitimate access
๐Ÿ“ Exam Watch Fail Secure = security priority (blocks access). Fail Safe = availability priority (allows access). Security exams favor Fail Secure.
Principle #7

๐Ÿ‘ฅ Separation of Duties

No single person has full control over an entire transaction. Tasks are split or shadowed between multiple people to prevent fraud.

Task Shadowing Task Splitting
๐Ÿ“Œ Example In a bank: Person A initiates a wire transfer, Person B must authorize it. Fraud requires both people to collude.
๐Ÿ“ Exam Watch SoD prevents any single employee from committing and concealing fraud. It's also a key control against insider threats.
Principle #8

๐ŸŒ Don't Trust External Systems

External systems are not under your organization's control. Treat them as insecure by default until trust is explicitly established through verification.

๐Ÿ’ก Tip Always validate, sanitize, and authenticate data from external APIs, partner networks, and third-party services โ€” never assume they are safe.
๐Ÿ“Œ Example A hospital receiving patient data from an external clinic should encrypt the connection and validate the data before importing it into their systems.
Principle #9

๐Ÿ›ก๏ธ Zero Trust

No actor, system, or service โ€” inside or outside the network โ€” is trusted by default. Every interaction must be verified before access is granted.

๐Ÿ“Œ Example An employee inside the corporate office still needs MFA + device verification to access the company file system. Being on the internal network is not enough.
๐Ÿ“ Exam Watch Zero Trust is the evolution of "don't trust external systems"-โ€”-extended-to-internal-systems-too.-Key-phrase:-"never trust, always verify."

โณ Security is a Process โ€” Not a Product

Every system has vulnerabilities. The goal is assurance, not perfection. Systems, requirements, and threat contexts all change over time. Secure systems need constant maintenance:

Check for obsolete users Update antivirus signatures Patch security holes Test firewalls regularly Review access controls
โš ๏ธ

Common Architecture Flaws

Attack types that exploit design and coding weaknesses

๐Ÿ“ก Covert Channels

A covert channel is an attack technique used to transfer information in a secretive, unauthorized, or illicit manner. It can be used to extract information from โ€” or implant information into โ€” an organization without detection.

โฑ๏ธ Covert Timing Channel One process accesses the data of another process through a shared resource such as RAM or CPU. The timing of operations leaks information.
๐Ÿ’พ Covert Storage Channel A process reads or writes to storage media to secretly communicate. Example: Android apps that request photo storage access may read metadata they shouldn't.

๐Ÿชค Maintenance Hook (Backdoor)

A trapdoor in software that allows developers easy maintenance access โ€” bypassing normal authentication. Left in production, it becomes a serious vulnerability.

๐Ÿ“ Exam Watch If an exam scenario describes hidden developer access that skips normal checks โ†’ Maintenance Hook / Backdoor.

๐Ÿง‚ Salami (Aggregation) Attack

Small attacks that individually go undetected, but add up to one major attack. Also called an incremental attack.

๐Ÿ“Œ Example A bank employee rounds down every transaction to the nearest cent and redirects those fractions to their account. Each transaction is negligible; over millions it becomes huge.

โœ๏ธ Data Diddling

Changing data before or during entry into a computer system. The data is altered at the input stage, making it hard to detect after the fact.

๐Ÿ“Œ Example A payroll clerk changes an employee's hours from 40 to 400 before submitting the timesheet to the payroll system.

๐Ÿ‘‘ Privileged Programs

Programs that can grant users extra privileges beyond what they are already assigned โ€” creating a pathway for privilege escalation attacks.

๐Ÿ“ Exam Watch Privileged programs violate least privilege. An attacker who exploits one can gain elevated access across the system.

๐Ÿ› ๏ธ How to Protect Against These Flaws

Trusted Recovery
Mechanisms to ensure that failures don't compromise secure operation. The system returns to a known-good secure state after a failure.
Input Validation
Validating and sanitizing all input before it is processed prevents data diddling, injection attacks, and parameter manipulation.
๐Ÿ›ก๏ธ

CIA Techniques

Ensuring Confidentiality, Integrity, and Availability

The CIA Triad in Software Design

Software designers use techniques to ensure programs do only what is required and nothing more. When controls fail: affected programs compromise Confidentiality โ†’ unpredictable data changes break Integrity โ†’ data corruption causes loss of Availability.

๐Ÿ”’ Confinement Confidentiality

Process confinement restricts a process to reading from and writing to only specific memory locations and resources. Used in operating systems for process isolation and memory protection.

๐Ÿ“Œ Example โ€” Sandboxing Sandboxie runs programs in an isolated environment so that any changes or malware cannot affect the host system or other programs. Web browsers use sandboxing to isolate tabs from each other and from the OS.
๐Ÿ’ก Tip Confinement = the concept. Sandboxing = a popular implementation of confinement.

๐Ÿ”ฌ Process Isolation Integrity

Process isolation ensures that the behavior of one process will only affect its own memory and resources. Separate processes cannot interfere with each other.

Each process gets its own virtual memory space. Page tables are disjoint โ€” no process can access another's memory pages. Virtual addresses for each process start from 0, but map to different physical locations.

๐Ÿ“ Exam Watch Process isolation is the OS mechanism that prevents a compromised process from reading another process's sensitive data (e.g., passwords in memory).

โญ• Bounds (Authority Levels) Access Control

Each process running on a system is assigned an authority level that tells the OS what the process is allowed to do. The ring model defines privilege levels:

Ring 0 โ€” Most Privileged Kernel โ€” Direct hardware access
Rings 1 & 2 Device Drivers โ€” Hardware management
Ring 3 โ€” Least Privileged Applications โ€” User programs
๐Ÿ“ Exam Watch The two most commonly tested authority levels are User mode (Ring 3) and Kernel mode (Ring 0). Kernel mode = full access. User mode = restricted access.
๐Ÿ—‚๏ธ

Security Models Overview

Frameworks for specifying and enforcing security policies

A security model is a scheme for specifying and enforcing security policies. It may be based on a formal model of access rights, computation, distributed computing, or no particular theoretical grounding.

Trusted Computing Base
State Machine Model
Information Flow Model
Noninterference Model
Take-Grant Model
Access Control Matrix
Bell-LaPadula Model โญ
Biba Model โญ
Clark-Wilson Model
Brewer & Nash (Chinese Wall)
Goguen-Meseguer Model
Sutherland Model
Graham-Denning Model
๐Ÿ’ก Study Tip Focus your exam prep on: Bell-LaPadula (confidentiality), Biba (integrity), Access Control Matrix, and Take-Grant. These appear most frequently.
โš–๏ธ

Bell-LaPadula vs. Biba

The two most tested security models

๐Ÿ”ต Bell-LaPadula Model Confidentiality

Designed to protect confidentiality in military-style clearance systems. Uses a linear ordering of security levels.

LevelSubjectObject
Top SecretTamaraPersonnel Files
SecretSamuelE-Mail Files
ConfidentialClaireActivity Logs
UnclassifiedAliceTelephone Lists
Two Core Rules No Read Up โ€” A subject cannot read objects at a higher level than their clearance.

No Write Down โ€” A subject cannot write data to a lower classification level (prevents leaking secrets).
๐Ÿ“Œ Examples โœ… Tamara (Top Secret) can read ALL files.
โŒ Claire (Confidential) CANNOT read Personnel or E-Mail Files.
โœ… Alice (Unclassified) can only read Telephone Lists.
๐Ÿ“ Exam Watch Bell-LaPadula = Confidentiality. "No Read Up, No Write Down." Military clearances. Remember: it does NOT protect integrity.

๐ŸŸข Biba Model Integrity

Designed to protect data integrity. The opposite philosophy of Bell-LaPadula โ€” focuses on preventing corruption of higher-integrity data.

Two Core Rules No Write Up โ€” A subject cannot write to a higher integrity level than their own (can't corrupt trusted data).

No Read Down โ€” A subject cannot read from a lower integrity level (prevents contamination by untrustworthy data).
๐Ÿ“Œ Example A Secret-level analyst cannot write changes to Top Secret documents (No Write Up). They also cannot read Unclassified internet sources and incorporate them into Secret reports (No Read Down โ€” data contamination risk).
๐Ÿ“ Exam Watch Biba = Integrity. "No Write Up, No Read Down." It's the reverse of Bell-LaPadula's reading direction. Biba does NOT protect confidentiality.
PropertyBell-LaPadulaBiba
GoalConfidentialityIntegrity
No ReadNo Read Up (can't-read-above-your-level)No-Read-Down-(can't read below your level)
No WriteNo Write Down (can't-write-below-your-level)No-Write-Up-(can't write above your level)
Use CaseMilitary / Government classificationFinancial / Database integrity systems
LimitationDoesn't-address-integrityDoesn't address confidentiality
๐Ÿ“ Memory Trick Bell-LaPadula: Think of a spy โ€” spies can't READ files above their clearance (No Read Up) and can't WRITE secrets down to lower levels (No Write Down) to prevent leaks.

Biba: Think of a chef โ€” they won't READ a recipe from a less-experienced cook (No Read Down = no contamination) and can't rewrite the head chef's cookbook (No Write Up = no corruption).
๐Ÿ“Š

Access Control Matrix

Mapping subjects, objects, and their access rights

An Access Control Matrix is a table that maps subjects (users) to objects (resources) and the rights each subject has over each object.

Columns โ†’ ACLs (tied to objects) Rows โ†’ Capability Lists (tied to subjects)
Subject \ Object File 1File 2File 3File 4 Account 1Account 2
John Own, R, Wโ€”Own, R, Wโ€” Inquiry, Creditโ€”
Alice ROwn, R, WWR Inquiry, DebitInquiry, Credit
Bob R, WRโ€”Own, R, W โ€”Inquiry, Debit
๐Ÿ“Œ Reading the Matrix If you look at Column "File 1" (the ACL): John (Own,R,W), Alice (R), Bob (R,W) โ€” these are all the subjects with access to File 1.

If you look at Row "Alice" (her Capability List): File 1 (R), File 2 (Own,R,W), File 3 (W), File 4 (R), Account 1 (Inquiry, Debit), Account 2 (Inquiry, Credit) โ€” these are all the things Alice can do.
๐Ÿ“ Exam Watch ACL = per-object view (who can access this file?). Capability List = per-subject view (what can this user access?). Both come from the same matrix โ€” just read in different directions.
๐Ÿ”„

Take-Grant Model

Tracking how rights propagate through a system

The Take-Grant model dictates how rights can be passed between subjects. It's used to determine when rights can change and where privilege leakage occurs.

RuleDescriptionNotation
Take Rule Allows a subject to take rights over an object from another subject "x takes (ฮฑ to z) from y"
Grant Rule Allows a subject to grant rights to an object to another subject "x grants (ฮฑ to z) to y"
Create Rule Allows a subject to create new rights "x-creates-(ฮฑ-to)-new-{subject/object}-n"
Remove Rule Allows a subject to remove rights it holds "x removes (ฮฑ to) y"
๐Ÿ’ก Key Insight The Take-Grant model lets security analysts determine when rights in a system can change and identify where privilege leakage might occur โ€” i.e., how an unauthorized party could gain access rights through a chain of grants and takes.
๐Ÿ“Œ Example of Leakage Alice grants Bob the "read" right on File X. Bob then takes that right and grants it to Charlie (who was not authorized). Through a chain of Take-Grant operations, Charlie now has unauthorized access โ€” this is privilege leakage.
๐Ÿ“ Exam Watch Take-Grant is about tracing permission propagation. Exam questions might ask you to follow a chain of rules to determine if a subject can gain access to a resource they weren't originally authorized for.