# CISSP Domain 3 — Build security in, not on

Source: https://ai.techclick.in/blog_cissp_d3_architecture_engineering
Markdown: https://ai.techclick.in/blog_cissp_d3_architecture_engineering.md
Publisher: Techclick Infosec Pvt Ltd

CISSP Domain 3 (13%): pick the design principle, the security model, the crypto family, and the site control — as a manager who scopes risk and an engineer who proves the control.

Quick answer

   Domain 3 is not “memorise BLP arrows.” It is  name the property the system must enforce , then  bake the control into design , then  prove it after go-live . Simple = read. Star (*) = write. Bell-LaPadula keeps secrets: no read up, no write down. Biba keeps integrity: no read down, no write up. Clark-Wilson adds well-formed transactions and separation of duties — a lattice alone is not a ledger. Brewer-Nash (Chinese Wall) is history-based conflict of interest. Bulk data uses a symmetric cipher; the session key rides an asymmetric (or PQC) wrap. Occupied server rooms get a clean agent, not water and not CO 2 . A manager’s first move after a forged payment is the requirement and the model, not a purchase order for a WAF.

   Say this out loud

   I do not bolt security onto a finished box. I pick the property — secrecy, integrity, conflict, or safety — then the principle, then the crypto or the room, and I leave evidence that the control fails closed.

## 1. Why Domain 3 matters

 ISC2 weights  Security Architecture and Engineering  at  13%  of the CISSP CAT (exam outline effective 15 April 2024). The official verbs run from “research, implement and manage engineering processes using secure design principles” through models, system capabilities, crypto, site design, and the information-system lifecycle. The exam — and a real architecture board — punish the same mistake: treating security as a product you add after the code ships.

 That is the ticket in this lesson. The API defaulted to open. One person owned create and approve. The WAF never saw a well-formed but fraudulent transformation. Domain 3 would have stopped that at design time:  secure defaults ,  segregation of duties , and a  Clark-Wilson  access triple — subject, approved program, constrained data item.

   Hero · design, model, crypto, site

   Notice: four jobs, one domain. Principles first. Then the formal rule. Then the key. Then the room. A WAF is none of those by itself.

#### Manager lens

 Which property must this system enforce, who owns residual risk, and which document is mandatory? Buy nothing until the requirement and the fail-closed behaviour exist on paper.

#### Engineer lens

 Which rule, algorithm, or physical control actually implements that property? If the control cannot fail closed or the private key is shared, the model is a slide.

   Official outline (what this page covers)

    3.1  Secure design principles (threat modeling through SASE).  3.2  Security models (Biba, Star Model, Bell-LaPadula).  3.3–3.5  Select controls; IS capabilities (memory protection, TPM, encryption); architecture vulnerabilities.  3.6–3.7  Cryptographic solutions and cryptanalytic attacks.  3.8–3.9  Site and facility.  3.10  Information-system lifecycle. Source:  ISC2 CISSP Certification Exam Outline . Domain 3’s official weight is 13% of the whole exam — that is the only percentage this page uses.

## 2. Mental model — principles and models

 Hold three parts. Interviews fail when people treat CIA as a slogan, treat “policy” as any PDF, or recite BLP arrows without saying which  property  the stem needs.

   Journey · goal, lattice, rule, enforce

   Read left to right. Enforce is not optional decoration. If the reference monitor is not always invoked, the lattice is theatre.

### Part 1 · hard words before the arrows

   Pre-train these before the runbook

    Subject / object  — who acts versus what is acted on. A process is a subject; a file is an object.

    Lattice  — ordered levels (Top Secret > Secret > Confidential, or High integrity > Low). Up and down only make sense on a lattice.

    Simple vs Star (*)  — Simple is always the  read  rule. Star is always the  write  rule. The outline’s “Star Model” is that write rule, not a third lattice.

    Reference monitor  — the abstract enforcer of every access. Its implementation is the security kernel. Well-known CBK: always invoked, tamperproof, small enough to verify.

    Fail securely  — on failure the system moves to a more-secure (usually closed) state. A crashed firewall that passes traffic failed  open .

    Fail-safe  — on failure, protect human life (unlock the fire door). Do not swap these two on a life-safety stem.

### Part 2 · 3.1 principles (official list, one-line each)

 Objective 3.1 is not a vibe. It is eleven named ideas. A FIRST stem almost always names one of them.

       Principle (3.1)  If X, then Y  Classic miss

        Threat modeling  If you have not enumerated abuse, you are guessing  Buying a control before STRIDE / attack trees
        Least privilege  If the job needs read, do not grant admin  Shared “break-glass” that never expires
        Defense in depth  If one layer dies, the next still holds  One “silver bullet” product
        Secure defaults  If nobody configures it, it stays locked  Ship open, harden later
        Fail securely  If the box crashes, deny (unless life-safety)  Fail-open “for availability”
        Segregation of duties (SoD)  If one person can create and approve, fraud is one ticket  Same engineer writes and releases
        Keep it simple and small  If the TCB is huge, you cannot verify it  Feature sprawl as “flexibility”
        Zero trust / trust but verify  If location is the only check, lateral movement is free  “Inside the firewall is trusted”
        Privacy by design  If privacy is bolted on, it will leak  Collect first, minimise later
        Shared responsibility  If the CSP patches the hypervisor, you still own the data and IAM  “It is in the cloud, so they secure it”
        SASE  If users are everywhere, security follows identity, not the castle  Treating SASE as a LAN replacement

   Common trap

   Do not confuse fail-secure with fail-safe. Fail-secure prioritises confidentiality and integrity (lock the door). Fail-safe prioritises human life (unlock the door so people leave a fire). The exam tests which goal the stem privileges.

### Part 3 · 3.2 models — pick the property, then the name

 The official examples are  Biba, Star Model, Bell-LaPadula . Well-known CBK that the CAT still uses: Clark-Wilson (commercial integrity) and Brewer-Nash / Chinese Wall (conflict of interest). Learn the  goal , not a mnemonic tattoo.

   Flow 1 · Simple = read, Star = write

       Bell-LaPadula confidentiality lattice versus Biba integrity lattice

- Bell-LaPadula · confidentiality Biba · integrity Top Secret / High Secret / Mid · you are here Confidential / Low High integrity Mid integrity · you are here Low integrity Simple: no read up Star (*): no write down Simple: no read down Star (*): no write up Stops leaks of classified data Stops dirty data contaminating clean Strong star (both models): read and write only at your own level. Discretionary matrix can still deny a same-level access. Read both columns. Simple never becomes a write rule. Reverse up/down when you switch from secrets to integrity. Model Protects Rule you must say Use when Bell-LaPadula Confidentiality No read up (Simple). No write down (Star). Military / classified labels Star Model (*) The write rule Star = write. BLP star blocks downward leaks. Biba star blocks upward contamination. Any stem that is about writing, not reading Biba Integrity (lattice) No read down. No write up. Invocation: do not call a higher-integrity subject. Do not let dirty data poison clean Clark-Wilson Commercial integrity Subject → transformation procedure → constrained data item. SoD + audit. Ledgers, payments, well-formed transactions Brewer-Nash Conflict of interest Access history dynamically walls you off from a competitor’s dataset. Consultants, banks, law firms Say this out loud Simple is read. Star is write. BLP stops leaks. Biba stops dirt. Clark-Wilson forces an approved program and two people. Brewer-Nash remembers who you already touched. ## 3. Decision flow — pick the property Decision · the first diamond is the property, not the product Caption, not the art: you only reach “buy the WAF” after you know whether the stem is a leak, a poison, a conflict, or a safety-critical fail-open. Skipping the property is the engineer-brain miss. Flow 2 · from ticket to model Decision flow from a new system to the security model and principle New system, API, plant, or facility Name the asset + owner Life-safety on failure? yes Fail-safe unlock / escape no · security first What must not happen? Leak of a secret BLP + Star no write down Dirty data up Biba + Star no write up Fraud on a ledger Clark-Wilson + SoD Conflict of interest Brewer-Nash / Chinese Wall Then apply 3.1: secure defaults, least privilege, fail securely, keep it small. Read top → bottom. Diamond = decision. Green border = commercial integrity or life-safety, not a lattice slogan. “Ignore” is not a model. ## 4. How to choose crypto and site controls Objective 3.6 is select cryptographic solutions: lifecycle, methods (symmetric, asymmetric, elliptic curves, quantum), and PKI including quantum key distribution. Objective 3.7 is the attack list. Objectives 3.8–3.9 are the site. Do not mix the three jobs. Feel · symmetric, hybrid, PQC, TPM Bulk data is fast and symmetric. The wrap that carries the session key is asymmetric or PQC. The chip that seals the key is a TPM or HSM. Exact names are in the tables. ### Crypto menu (outline words, not vendor words) Job Prefer Why Do not pick Encrypt 500 GB tonight AES (FIPS 197), authenticated mode (GCM) Symmetric is fast; one shared key RSA on the whole file Carry that AES key over an untrusted path Recipient’s public key, or ML-KEM (FIPS 203) Asymmetric / KEM solves distribution Emailing the AES key in the clear; sharing a private key Prove who signed and they cannot deny it Digital signature (FIPS 186-5, or ML-DSA FIPS 204) Only a uniquely held private key gives non-repudiation Encryption alone; a shared signing key Integrity of a file, no identity claim SHA-2 / SHA-3 hash, or HMAC if you share a key One-way fingerprint Calling a hash “encryption” Long-lived data, harvest-now-decrypt-later Crypto-agile path to FIPS 203 / 204 / 205 Shor breaks RSA/ECC; Grover only halves symmetric strength “We use AES-256, so RSA-2048 is fine forever” Physics-layer key agreement (outline names it) Quantum key distribution (QKD) Detect eavesdropping on the quantum channel Treating QKD as a drop-in for TLS certificates NIST PQC — official names, August 2024 FIPS 203 ML-KEM (from CRYSTALS-Kyber) — key encapsulation; parameter sets ML-KEM-512 / 768 / 1024. FIPS 204 ML-DSA (from Dilithium) — module-lattice signatures. FIPS 205 SLH-DSA (from SPHINCS+) — stateless hash-based signatures, a non-lattice fallback. Source: NIST PQC FIPS approval . Hybrid (classical + PQC) is a migration pattern, not a replacement for key custody. ### Cryptanalytic attacks (3.7 — official list) Attack What the attacker has / does First defence Brute force Tries every key Adequate key length; rate-limit Ciphertext-only Only intercepted ciphertext Modern ciphers; no classic substitution Known plaintext Some plaintext + matching ciphertext Do not reuse keys / IVs Frequency analysis Letter / block statistics Not a threat to AES; kills Caesar / Vigenère Chosen ciphertext Feeds crafted ciphertext, watches decrypt Authenticated encryption; do not leak padding oracles Implementation / side-channel / timing / fault Power, cache, clock, injected faults Constant-time code; HSM; physical shielding MITM Sits between parties Authenticated key exchange; pin / validate certs Pass the hash / Kerberos exploitation Replays a hash or ticket, never the password Credential guard, short ticket life, no NTLM Ransomware Adversary-controlled encryption of your data Backups offline; least privilege; restore test ### Site and facility (3.8–3.9) Apply the same layered idea to dirt and concrete. Concentric rings: perimeter, building, interior, data hall. CPTED (well-known CBK): natural surveillance, natural access control, territorial reinforcement. Functional goals: deter, detect, delay, respond. Outline object Control Exam judgment Wiring closet / IDF Locked, logged, no public corridor latch A closet is a network core, not a broom room Server room / data centre Mantrap, badge + PIN, cameras, raised floor / hot-aisle Two-person integrity on the inner door if the stem is high-value Media / evidence storage Dual control, chain of custody, fire-rated media vault Evidence is a legal object, not a backup tape pile HVAC / environment Independent cooling, water sensors, ASHRAE-range temperature Heat is an availability attack Power UPS then generator; redundant feeds UPS is ride-through. Generator is sustainment. Both, not either. Fire — occupied + electronics Clean agent (e.g. FM-200 / HFC-227ea, Novec 1230 / FK-5-1-12) Water destroys gear. CO 2 displaces oxygen and can kill staff. Fire classes (CBK) A ordinary, B liquids, C electrical, D metals, K cooking oils Do not put water on a live Class C rack Exam trap “Encryption makes us quantum-safe.” Symmetric AES-256 still has a huge work factor after Grover. RSA and ECC do not survive Shor. Long-lived records that were wrapped with RSA-2048 are the harvest-now-decrypt-later case. QKD is a named PKI-adjacent method in the outline; it is not the same as ML-KEM. ## 5. Runbook — manager, then engineer, then prove This is not a CLI lab. It is the architecture-board sequence ISC2 wants when the stem says FIRST or BEST after a design failure. Source for the manager half: official 3.1 + 3.10 (lifecycle). Source for crypto: NIST SP 800-57 Part 1 and FIPS 203/204/205. Source for the site: official 3.8–3.9. ### Side A — Manager / CISO (scope before spend) #### Name the asset, the owner, and the property Ledger integrity, classified design, conflicted client file, occupied hall — not “the network.” The data owner classifies. Security does not invent the label.

- #### Threat-model before the purchase STRIDE (spoof, tamper, repudiate, info-disclose, DoS, elevate) is the well-known whiteboard. If this sheet does not exist, any WAF or HSM purchase is decoration.

- #### Pick the principle and the model from residual risk SoD + Clark-Wilson if one person can commit fraud. BLP if a downward write leaks a secret. Fail-safe if a locked door kills people. Record the residual risk the owner accepts.

- #### Write the standard, then fund the tool Policy → standard → procedure. “Buy a next-gen WAF” is not a first move. “Payments change only through an approved TP, two people, fail closed” is.

### Side B — Engineer (design the control)

- #### Map the architecture element (3.5) Client, server, database, crypto module, ICS, cloud (IaaS/PaaS/SaaS — shared responsibility), container, serverless, IoT, embedded, HPC, edge, virtualized. The vuln class follows the element: VM escape is a hypervisor problem; a poisoned training set is a supply-chain problem; an exposed PLC is an ICS problem.

- #### Implement IS capabilities (3.4) Memory protection: rings, ASLR, NX/DEP, process isolation. TPM (ISO/IEC 11889): hardware root of trust, measured boot, sealed keys, attestation. Encryption/decryption: keys in an HSM or TPM, never in a shared folder. FIPS 140-3 is the module validation program — do not invent a “Level 5.”

- #### Build the crypto and the room you were given AES-GCM for bulk. Public-key or ML-KEM wrap for the session key. Signatures with a uniquely held private key. Occupied data hall: clean agent + UPS + generator. Closets locked. Evidence under dual control.

- #### Close the TOCTOU and covert-channel windows Check-and-use must be one locked operation. Covert storage and timing channels are unintended paths — rate-limit, isolate shared resources, audit unusual clock or temp-file use.

### Side C — Prove (pilot, then expand)

- #### Pick one fail-closed story A single engineer cannot both create and approve a vendor. A Secret subject cannot write a Top Secret object into a Confidential share. A crashed policy engine denies. Write those as pass/fail before go-live.

- #### Instrument the path Access-triple logs (who, which TP, which CDI). TPM attestation on boot. Key-lifecycle record (generate, distribute, store, use, rotate, archive, revoke, destroy — SP 800-57). Clean-agent system test and UPS transfer test.

- #### Break it on purpose Attempt the forbidden write, the shared signing key, the fail-open reboot. Expect deny + log. If it succeeds, the model was a costume.

   Pilot evidence — fields a reviewer should see
   asset=vendor-ledger
owner=finance-controller
property=integrity+SoD
model=clark-wilson
tp=create-vendor | approve-payment
subject_create != subject_approve
action=deny
reason=same-subject-both-roles
fail_mode=closed
aes_at_rest=AES-256-GCM
key_wrap=ML-KEM-768 | RSA-OAEP (migration flagged)
sig=ML-DSA | FIPS-186-5
privkey_custody=hsm-partition unique
tpm=measured-boot attest=pass
fire=clean-agent occupied=yes
ups=transfer-ok generator=tested

## 6. Runtime path — keys, TPM, facility

 Two pictures after go-live. First the cryptographic object. Then the building that keeps the module honest. Objective  3.10  is the lifecycle that wraps both: stakeholder needs → requirements → architectural design → development → integration → verification and validation → transition → operations / sustainment → retirement / disposal.

   Proof · the desk and the aisle that close the ticket

   Green is not a vibe. Green is deny on the forbidden role pair, attestation pass, key-destruction record, clean-agent and UPS tests dated.

   Flow 3 · key object and concentric site

       Cryptographic lifecycle above concentric site rings

- Generate Distribute Use Rotate Revoke Destroy SP 800-57 key lifecycle · store and archive sit under Use · never skip Destroy Perimeter · fence, lighting, CPTED Building · badge, mantrap, cameras Interior · IDF locks, restricted work area Data hall HSM · TPM · clean agent · UPS A stolen laptop outside the inner ring must not hold the unsealed private key. Keys live a lifecycle. The building is a set of rings. Retirement (3.10) includes crypto-shred and media destruction, not just unplugging a rack. #### Shared responsibility (3.1) IaaS: you own OS, data, IAM, crypto. PaaS: you own the app and data. SaaS: you own identity, classification, and what you put in. The CSP’s SOC 2 does not accept your residual risk. #### SASE (3.1) Secure access service edge is identity-following access, not a new castle. It does not write the Clark-Wilson triple inside the ledger, and it does not pick your fire agent. ## 7. Traps and proof Trap What people say What is actually true Fix Arrows without a property “No read up, no write down” for every stem That is BLP confidentiality. Integrity flips it. Ask what must not happen, then name the model. Biba as a ledger “No write up covers payments.” Biba is a lattice. It does not force a well-formed TP or SoD. Clark-Wilson access triple + audit. Fail-open as availability “If the firewall dies, pass traffic.” That is fail-open. 3.1 says fail securely unless life-safety. Fail-closed for secrets; fail-safe for people. RSA on bulk data “Stronger key, encrypt the warehouse.” Asymmetric is for wrap and sign. Symmetric is for bulk. Hybrid: AES + public-key / ML-KEM wrap. Shared signing key “The team mailbox signs contracts.” Non-repudiation dies the moment two people can sign. Unique private key in an HSM partition. Quantum-safe slogan “We encrypt, so we are fine.” Shor kills RSA/ECC. Harvest-now is a 3.6 problem today. Inventory + crypto-agility + FIPS 203/204/205. Water or CO 2 in an occupied hall “Sprinklers are code; CO 2 is clean.” Water kills electronics. CO 2 can kill people. Clean agent for occupied + electronics. Cloud = their problem “Shared responsibility means they patch everything.” You still own data, keys, IAM, and classification. Write the split. Accept residual risk in writing. Pilot checklist — print this Property named (secrecy / integrity / conflict / safety) and signed by the asset owner.

- Threat model dated before the purchase order.

- SoD: create ≠ approve on the payment path; log proves it.

- Forbidden BLP/Biba write fails and is logged.

- API / product ships deny-by-default (secure defaults).

- Firewall / policy engine fails closed; fire doors fail safe.

- Bulk = AES-GCM. Wrap = public-key or ML-KEM. Sign = unique private key.

- PQC migration flagged for data that must stay secret past the RSA/ECC horizon.

- TPM measured-boot attest = pass; HSM partition is not a shared folder.

- Occupied hall: clean agent, UPS transfer, generator test, IDF locked.

- Lifecycle (3.10): V&V evidence and a retirement/crypto-shred plan exist.

   Interview pair — weak vs strong

    Weak:  “Domain 3 is Bell-LaPadula and AES.”  Strong:  “I name the property first. Secrets get BLP — simple no-read-up, star no-write-down. Ledgers get Clark-Wilson and two people. Bulk data is AES; the wrap is asymmetric or ML-KEM; the signature key is uniquely held. The room fails safe for people and the control plane fails closed for data. I can show the deny log, the attestation, and the key-destruction record.”

## Knowledge check

   Six judgment items. Same traps the CAT uses: fail-secure vs fail-safe, Star as write, hybrid crypto, Biba as a fake ledger, occupied-room fire, harvest-now-decrypt-later. Check answers, then reset if you miss any.

       Q1
       A policy engine crashes during a change window. Leadership wants “availability first.” Which 3.1 behaviour is correct for a confidentiality-critical control plane that is  not  a life-safety door?

           Fail securely — deny traffic until the engine is back
           Fail-safe — unlock every door and pass all packets so people can work
           Least privilege — drop every user to guest and keep the engine up
           SASE — move the crash into a cloud edge so it no longer matters

       Correct:  a . Fail securely means a failure drives the system to a more-secure state. Fail-safe is the life-safety exception (unlock so people escape). Least privilege and SASE do not answer a crash. Re-read  Mental model .

       Q2
       A defence contractor needs a model that stops a Secret-cleared engineer from copying a Top Secret design into a Confidential shared folder. Which rule must the system enforce?

           Bell-LaPadula Simple Security Property (no read up)
           Biba Star Integrity Axiom (no write up)
           Bell-LaPadula Star Property (no write down)
           Clark-Wilson access triple

       Correct:  c . The leak is writing sensitive data  down  to a lower classification — BLP Star (no write down). Simple blocks reading, not this write. Biba and Clark-Wilson are integrity models. Re-read  models  and  Decision flow .

       Q3
       A fintech team must encrypt 500 GB of nightly database backups quickly, and also carry the key across an untrusted link. Which design matches CISSP practice?

           Encrypt all 500 GB directly with RSA-4096 for maximum strength
           Use AES for the backups and wrap the AES key with the recipient’s public key (or ML-KEM)
           Hash the backups with SHA-256 and send the digest over TLS
           Encrypt the backups with the recipient’s RSA private key, then share that private key

       Correct:  b . Hybrid: fast symmetric for bulk, asymmetric or ML-KEM for distribution. RSA on 500 GB is the wrong job. A hash is not encryption. Private keys are never shared. Re-read  How to choose .

       Q4
       Auditors want users to change ledger records only through approved programs, with separation of duties and full logging — never by editing files. A new hire says Biba “no write up” already covers this. Why is Biba alone insufficient?

           Biba enforces confidentiality, so it cannot protect integrity at all
           Biba prevents contamination by level but does not mandate well-formed transactions, SoD, or the access triple
           Biba already requires constrained data items and transformation procedures
           Biba’s no-read-down rule forces all edits through approved programs

       Correct:  b . Biba is a lattice. Clark-Wilson adds the subject–TP–CDI triple, SoD, and audit. Biba is an integrity model, not a confidentiality model. Re-read the model table and  Decision flow .

       Q5
       A new data-centre room will have engineers working inside the racks. You must pick fire suppression that protects both staff and servers. Which choice fits?

           A wet-pipe water sprinkler system over the server racks
           A CO 2  flooding system triggered on first smoke
           A manual-extinguisher-only policy with no automatic system
           A clean-agent system (for example FM-200 / HFC-227ea or Novec 1230 / FK-5-1-12)

       Correct:  d . Clean agents suppress without drowning electronics and are used in occupied spaces. Water destroys equipment. CO 2  can asphyxiate staff. Manual-only is not a suppression system. Re-read  site and facility .

       Q6
       Twenty-five-year loan records travel under RSA-2048 TLS and sit encrypted at rest. Management says “encryption makes them quantum-safe.” Which risk is most under-addressed?

           AES-256 at rest will be trivially broken by Grover’s algorithm within a year
           RSA-protected data captured today can be decrypted post-quantum — harvest-now-decrypt-later — so long-lived records need a PQC key-establishment path (FIPS 203)
           TLS 1.3 is inherently insecure and must be downgraded to TLS 1.2
           A TPM measured boot would fully solve confidentiality of stored ciphertext

       Correct:  b . Shor breaks RSA/ECC. Twenty-five-year data outlives that horizon. AES-256 only loses roughly half its bits to Grover and is not “trivial.” TLS 1.3 is the living standard. A TPM seals runtime keys; it does not un-harvest last year’s ciphertext. Re-read  crypto menu  and  runtime path .

       Check answers
       Reset

## Sources

- ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Domain 3 weight 13%. Objectives 3.1–3.10 are the spine of this lesson. PDF: CISSP-Exam-Outline-April-2024-English.pdf . No other exam percentages are claimed.

- NIST — FIPS 203 ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), 13 August 2024. Parameter sets ML-KEM-512 / 768 / 1024.

- NIST — FIPS 204 ML-DSA and FIPS 205 SLH-DSA. Approval note: Post-Quantum Cryptography FIPS Approved .

- NIST — FIPS 197 AES. FIPS 186-5 Digital Signature Standard. FIPS 140-3 Security Requirements for Cryptographic Modules.

- NIST — SP 800-57 Part 1 Rev. 5 , Recommendation for Key Management (generate through destroy).

- NIST — SP 800-207 Zero Trust Architecture — no implicit trust from location.

- ISO/IEC 11889 — Trusted Platform Module. Memory-protection and reference-monitor properties are well-known CBK (Anderson / TCSEC lineage), not an ISC2 percentage claim.

- Well-known CBK (not an ISC2 sub-weight): Clark-Wilson access triple; Brewer-Nash / Chinese Wall; STRIDE; CPTED; fire classes A–D/K; clean-agent vs water vs CO 2 in occupied electronics spaces; fail-secure vs fail-safe.

 Related:  Domain 2 · Asset Security  ·  Domain 4 · Communication and Network Security  ·  All 8 domains map  ·  Domain 3 timed assessment  ·  8-week roadmap

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt