Domain 3 is not “memorise BLP arrows.” It is name the property the system must enforce, then bake the control into design, then prove it after go-live. Simple = read. Star (*) = write. Bell-LaPadula keeps secrets: no read up, no write down. Biba keeps integrity: no read down, no write up. Clark-Wilson adds well-formed transactions and separation of duties — a lattice alone is not a ledger. Brewer-Nash (Chinese Wall) is history-based conflict of interest. Bulk data uses a symmetric cipher; the session key rides an asymmetric (or PQC) wrap. Occupied server rooms get a clean agent, not water and not CO2. A manager’s first move after a forged payment is the requirement and the model, not a purchase order for a WAF.
I do not bolt security onto a finished box. I pick the property — secrecy, integrity, conflict, or safety — then the principle, then the crypto or the room, and I leave evidence that the control fails closed.
1. Why Domain 3 matters
ISC2 weights Security Architecture and Engineering at 13% of the CISSP CAT (exam outline effective 15 April 2024). The official verbs run from “research, implement and manage engineering processes using secure design principles” through models, system capabilities, crypto, site design, and the information-system lifecycle. The exam — and a real architecture board — punish the same mistake: treating security as a product you add after the code ships.
That is the ticket in this lesson. The API defaulted to open. One person owned create and approve. The WAF never saw a well-formed but fraudulent transformation. Domain 3 would have stopped that at design time: secure defaults, segregation of duties, and a Clark-Wilson access triple — subject, approved program, constrained data item.
Manager lens
Which property must this system enforce, who owns residual risk, and which document is mandatory? Buy nothing until the requirement and the fail-closed behaviour exist on paper.
Engineer lens
Which rule, algorithm, or physical control actually implements that property? If the control cannot fail closed or the private key is shared, the model is a slide.
3.1 Secure design principles (threat modeling through SASE). 3.2 Security models (Biba, Star Model, Bell-LaPadula). 3.3–3.5 Select controls; IS capabilities (memory protection, TPM, encryption); architecture vulnerabilities. 3.6–3.7 Cryptographic solutions and cryptanalytic attacks. 3.8–3.9 Site and facility. 3.10 Information-system lifecycle. Source: ISC2 CISSP Certification Exam Outline. Domain 3’s official weight is 13% of the whole exam — that is the only percentage this page uses.
2. Mental model — principles and models
Hold three parts. Interviews fail when people treat CIA as a slogan, treat “policy” as any PDF, or recite BLP arrows without saying which property the stem needs.
Part 1 · hard words before the arrows
Subject / object — who acts versus what is acted on. A process is a subject; a file is an object.
Lattice — ordered levels (Top Secret > Secret > Confidential, or High integrity > Low). Up and down only make sense on a lattice.
Simple vs Star (*) — Simple is always the read rule. Star is always the write rule. The outline’s “Star Model” is that write rule, not a third lattice.
Reference monitor — the abstract enforcer of every access. Its implementation is the security kernel. Well-known CBK: always invoked, tamperproof, small enough to verify.
Fail securely — on failure the system moves to a more-secure (usually closed) state. A crashed firewall that passes traffic failed open.
Fail-safe — on failure, protect human life (unlock the fire door). Do not swap these two on a life-safety stem.
Part 2 · 3.1 principles (official list, one-line each)
Objective 3.1 is not a vibe. It is eleven named ideas. A FIRST stem almost always names one of them.
| Principle (3.1) | If X, then Y | Classic miss |
|---|---|---|
| Threat modeling | If you have not enumerated abuse, you are guessing | Buying a control before STRIDE / attack trees |
| Least privilege | If the job needs read, do not grant admin | Shared “break-glass” that never expires |
| Defense in depth | If one layer dies, the next still holds | One “silver bullet” product |
| Secure defaults | If nobody configures it, it stays locked | Ship open, harden later |
| Fail securely | If the box crashes, deny (unless life-safety) | Fail-open “for availability” |
| Segregation of duties (SoD) | If one person can create and approve, fraud is one ticket | Same engineer writes and releases |
| Keep it simple and small | If the TCB is huge, you cannot verify it | Feature sprawl as “flexibility” |
| Zero trust / trust but verify | If location is the only check, lateral movement is free | “Inside the firewall is trusted” |
| Privacy by design | If privacy is bolted on, it will leak | Collect first, minimise later |
| Shared responsibility | If the CSP patches the hypervisor, you still own the data and IAM | “It is in the cloud, so they secure it” |
| SASE | If users are everywhere, security follows identity, not the castle | Treating SASE as a LAN replacement |
Do not confuse fail-secure with fail-safe. Fail-secure prioritises confidentiality and integrity (lock the door). Fail-safe prioritises human life (unlock the door so people leave a fire). The exam tests which goal the stem privileges.
Part 3 · 3.2 models — pick the property, then the name
The official examples are Biba, Star Model, Bell-LaPadula. Well-known CBK that the CAT still uses: Clark-Wilson (commercial integrity) and Brewer-Nash / Chinese Wall (conflict of interest). Learn the goal, not a mnemonic tattoo.
Read both columns. Simple never becomes a write rule. Reverse up/down when you switch from secrets to integrity.
| Model | Protects | Rule you must say | Use when |
|---|---|---|---|
| Bell-LaPadula | Confidentiality | No read up (Simple). No write down (Star). | Military / classified labels |
| Star Model (*) | The write rule | Star = write. BLP star blocks downward leaks. Biba star blocks upward contamination. | Any stem that is about writing, not reading |
| Biba | Integrity (lattice) | No read down. No write up. Invocation: do not call a higher-integrity subject. | Do not let dirty data poison clean |
| Clark-Wilson | Commercial integrity | Subject → transformation procedure → constrained data item. SoD + audit. | Ledgers, payments, well-formed transactions |
| Brewer-Nash | Conflict of interest | Access history dynamically walls you off from a competitor’s dataset. | Consultants, banks, law firms |
Simple is read. Star is write. BLP stops leaks. Biba stops dirt. Clark-Wilson forces an approved program and two people. Brewer-Nash remembers who you already touched.
3. Decision flow — pick the property
Read top → bottom. Diamond = decision. Green border = commercial integrity or life-safety, not a lattice slogan. “Ignore” is not a model.
4. How to choose crypto and site controls
Objective 3.6 is select cryptographic solutions: lifecycle, methods (symmetric, asymmetric, elliptic curves, quantum), and PKI including quantum key distribution. Objective 3.7 is the attack list. Objectives 3.8–3.9 are the site. Do not mix the three jobs.
Crypto menu (outline words, not vendor words)
| Job | Prefer | Why | Do not pick |
|---|---|---|---|
| Encrypt 500 GB tonight | AES (FIPS 197), authenticated mode (GCM) | Symmetric is fast; one shared key | RSA on the whole file |
| Carry that AES key over an untrusted path | Recipient’s public key, or ML-KEM (FIPS 203) | Asymmetric / KEM solves distribution | Emailing the AES key in the clear; sharing a private key |
| Prove who signed and they cannot deny it | Digital signature (FIPS 186-5, or ML-DSA FIPS 204) | Only a uniquely held private key gives non-repudiation | Encryption alone; a shared signing key |
| Integrity of a file, no identity claim | SHA-2 / SHA-3 hash, or HMAC if you share a key | One-way fingerprint | Calling a hash “encryption” |
| Long-lived data, harvest-now-decrypt-later | Crypto-agile path to FIPS 203 / 204 / 205 | Shor breaks RSA/ECC; Grover only halves symmetric strength | “We use AES-256, so RSA-2048 is fine forever” |
| Physics-layer key agreement (outline names it) | Quantum key distribution (QKD) | Detect eavesdropping on the quantum channel | Treating QKD as a drop-in for TLS certificates |
FIPS 203 ML-KEM (from CRYSTALS-Kyber) — key encapsulation; parameter sets ML-KEM-512 / 768 / 1024. FIPS 204 ML-DSA (from Dilithium) — module-lattice signatures. FIPS 205 SLH-DSA (from SPHINCS+) — stateless hash-based signatures, a non-lattice fallback. Source: NIST PQC FIPS approval. Hybrid (classical + PQC) is a migration pattern, not a replacement for key custody.
Cryptanalytic attacks (3.7 — official list)
| Attack | What the attacker has / does | First defence |
|---|---|---|
| Brute force | Tries every key | Adequate key length; rate-limit |
| Ciphertext-only | Only intercepted ciphertext | Modern ciphers; no classic substitution |
| Known plaintext | Some plaintext + matching ciphertext | Do not reuse keys / IVs |
| Frequency analysis | Letter / block statistics | Not a threat to AES; kills Caesar / Vigenère |
| Chosen ciphertext | Feeds crafted ciphertext, watches decrypt | Authenticated encryption; do not leak padding oracles |
| Implementation / side-channel / timing / fault | Power, cache, clock, injected faults | Constant-time code; HSM; physical shielding |
| MITM | Sits between parties | Authenticated key exchange; pin / validate certs |
| Pass the hash / Kerberos exploitation | Replays a hash or ticket, never the password | Credential guard, short ticket life, no NTLM |
| Ransomware | Adversary-controlled encryption of your data | Backups offline; least privilege; restore test |
Site and facility (3.8–3.9)
Apply the same layered idea to dirt and concrete. Concentric rings: perimeter, building, interior, data hall. CPTED (well-known CBK): natural surveillance, natural access control, territorial reinforcement. Functional goals: deter, detect, delay, respond.
| Outline object | Control | Exam judgment |
|---|---|---|
| Wiring closet / IDF | Locked, logged, no public corridor latch | A closet is a network core, not a broom room |
| Server room / data centre | Mantrap, badge + PIN, cameras, raised floor / hot-aisle | Two-person integrity on the inner door if the stem is high-value |
| Media / evidence storage | Dual control, chain of custody, fire-rated media vault | Evidence is a legal object, not a backup tape pile |
| HVAC / environment | Independent cooling, water sensors, ASHRAE-range temperature | Heat is an availability attack |
| Power | UPS then generator; redundant feeds | UPS is ride-through. Generator is sustainment. Both, not either. |
| Fire — occupied + electronics | Clean agent (e.g. FM-200 / HFC-227ea, Novec 1230 / FK-5-1-12) | Water destroys gear. CO2 displaces oxygen and can kill staff. |
| Fire classes (CBK) | A ordinary, B liquids, C electrical, D metals, K cooking oils | Do not put water on a live Class C rack |
“Encryption makes us quantum-safe.” Symmetric AES-256 still has a huge work factor after Grover. RSA and ECC do not survive Shor. Long-lived records that were wrapped with RSA-2048 are the harvest-now-decrypt-later case. QKD is a named PKI-adjacent method in the outline; it is not the same as ML-KEM.
5. Runbook — manager, then engineer, then prove
This is not a CLI lab. It is the architecture-board sequence ISC2 wants when the stem says FIRST or BEST after a design failure. Source for the manager half: official 3.1 + 3.10 (lifecycle). Source for crypto: NIST SP 800-57 Part 1 and FIPS 203/204/205. Source for the site: official 3.8–3.9.
Side A — Manager / CISO (scope before spend)
-
Name the asset, the owner, and the property
Ledger integrity, classified design, conflicted client file, occupied hall — not “the network.” The data owner classifies. Security does not invent the label.
-
Threat-model before the purchase
STRIDE (spoof, tamper, repudiate, info-disclose, DoS, elevate) is the well-known whiteboard. If this sheet does not exist, any WAF or HSM purchase is decoration.
-
Pick the principle and the model from residual risk
SoD + Clark-Wilson if one person can commit fraud. BLP if a downward write leaks a secret. Fail-safe if a locked door kills people. Record the residual risk the owner accepts.
-
Write the standard, then fund the tool
Policy → standard → procedure. “Buy a next-gen WAF” is not a first move. “Payments change only through an approved TP, two people, fail closed” is.
Side B — Engineer (design the control)
-
Map the architecture element (3.5)
Client, server, database, crypto module, ICS, cloud (IaaS/PaaS/SaaS — shared responsibility), container, serverless, IoT, embedded, HPC, edge, virtualized. The vuln class follows the element: VM escape is a hypervisor problem; a poisoned training set is a supply-chain problem; an exposed PLC is an ICS problem.
-
Implement IS capabilities (3.4)
Memory protection: rings, ASLR, NX/DEP, process isolation. TPM (ISO/IEC 11889): hardware root of trust, measured boot, sealed keys, attestation. Encryption/decryption: keys in an HSM or TPM, never in a shared folder. FIPS 140-3 is the module validation program — do not invent a “Level 5.”
-
Build the crypto and the room you were given
AES-GCM for bulk. Public-key or ML-KEM wrap for the session key. Signatures with a uniquely held private key. Occupied data hall: clean agent + UPS + generator. Closets locked. Evidence under dual control.
-
Close the TOCTOU and covert-channel windows
Check-and-use must be one locked operation. Covert storage and timing channels are unintended paths — rate-limit, isolate shared resources, audit unusual clock or temp-file use.
Side C — Prove (pilot, then expand)
-
Pick one fail-closed story
A single engineer cannot both create and approve a vendor. A Secret subject cannot write a Top Secret object into a Confidential share. A crashed policy engine denies. Write those as pass/fail before go-live.
-
Instrument the path
Access-triple logs (who, which TP, which CDI). TPM attestation on boot. Key-lifecycle record (generate, distribute, store, use, rotate, archive, revoke, destroy — SP 800-57). Clean-agent system test and UPS transfer test.
-
Break it on purpose
Attempt the forbidden write, the shared signing key, the fail-open reboot. Expect deny + log. If it succeeds, the model was a costume.
asset=vendor-ledger owner=finance-controller property=integrity+SoD model=clark-wilson tp=create-vendor | approve-payment subject_create != subject_approve action=deny reason=same-subject-both-roles fail_mode=closed aes_at_rest=AES-256-GCM key_wrap=ML-KEM-768 | RSA-OAEP (migration flagged) sig=ML-DSA | FIPS-186-5 privkey_custody=hsm-partition unique tpm=measured-boot attest=pass fire=clean-agent occupied=yes ups=transfer-ok generator=tested
6. Runtime path — keys, TPM, facility
Two pictures after go-live. First the cryptographic object. Then the building that keeps the module honest. Objective 3.10 is the lifecycle that wraps both: stakeholder needs → requirements → architectural design → development → integration → verification and validation → transition → operations / sustainment → retirement / disposal.
Keys live a lifecycle. The building is a set of rings. Retirement (3.10) includes crypto-shred and media destruction, not just unplugging a rack.
Shared responsibility (3.1)
IaaS: you own OS, data, IAM, crypto. PaaS: you own the app and data. SaaS: you own identity, classification, and what you put in. The CSP’s SOC 2 does not accept your residual risk.
SASE (3.1)
Secure access service edge is identity-following access, not a new castle. It does not write the Clark-Wilson triple inside the ledger, and it does not pick your fire agent.
7. Traps and proof
| Trap | What people say | What is actually true | Fix |
|---|---|---|---|
| Arrows without a property | “No read up, no write down” for every stem | That is BLP confidentiality. Integrity flips it. | Ask what must not happen, then name the model. |
| Biba as a ledger | “No write up covers payments.” | Biba is a lattice. It does not force a well-formed TP or SoD. | Clark-Wilson access triple + audit. |
| Fail-open as availability | “If the firewall dies, pass traffic.” | That is fail-open. 3.1 says fail securely unless life-safety. | Fail-closed for secrets; fail-safe for people. |
| RSA on bulk data | “Stronger key, encrypt the warehouse.” | Asymmetric is for wrap and sign. Symmetric is for bulk. | Hybrid: AES + public-key / ML-KEM wrap. |
| Shared signing key | “The team mailbox signs contracts.” | Non-repudiation dies the moment two people can sign. | Unique private key in an HSM partition. |
| Quantum-safe slogan | “We encrypt, so we are fine.” | Shor kills RSA/ECC. Harvest-now is a 3.6 problem today. | Inventory + crypto-agility + FIPS 203/204/205. |
| Water or CO2 in an occupied hall | “Sprinklers are code; CO2 is clean.” | Water kills electronics. CO2 can kill people. | Clean agent for occupied + electronics. |
| Cloud = their problem | “Shared responsibility means they patch everything.” | You still own data, keys, IAM, and classification. | Write the split. Accept residual risk in writing. |
- Property named (secrecy / integrity / conflict / safety) and signed by the asset owner.
- Threat model dated before the purchase order.
- SoD: create ≠ approve on the payment path; log proves it.
- Forbidden BLP/Biba write fails and is logged.
- API / product ships deny-by-default (secure defaults).
- Firewall / policy engine fails closed; fire doors fail safe.
- Bulk = AES-GCM. Wrap = public-key or ML-KEM. Sign = unique private key.
- PQC migration flagged for data that must stay secret past the RSA/ECC horizon.
- TPM measured-boot attest = pass; HSM partition is not a shared folder.
- Occupied hall: clean agent, UPS transfer, generator test, IDF locked.
- Lifecycle (3.10): V&V evidence and a retirement/crypto-shred plan exist.
Weak: “Domain 3 is Bell-LaPadula and AES.” Strong: “I name the property first. Secrets get BLP — simple no-read-up, star no-write-down. Ledgers get Clark-Wilson and two people. Bulk data is AES; the wrap is asymmetric or ML-KEM; the signature key is uniquely held. The room fails safe for people and the control plane fails closed for data. I can show the deny log, the attestation, and the key-destruction record.”
Knowledge check
Six judgment items. Same traps the CAT uses: fail-secure vs fail-safe, Star as write, hybrid crypto, Biba as a fake ledger, occupied-room fire, harvest-now-decrypt-later. Check answers, then reset if you miss any.
Sources
- ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Domain 3 weight 13%. Objectives 3.1–3.10 are the spine of this lesson. PDF: CISSP-Exam-Outline-April-2024-English.pdf. No other exam percentages are claimed.
- NIST — FIPS 203 ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), 13 August 2024. Parameter sets ML-KEM-512 / 768 / 1024.
- NIST — FIPS 204 ML-DSA and FIPS 205 SLH-DSA. Approval note: Post-Quantum Cryptography FIPS Approved.
- NIST — FIPS 197 AES. FIPS 186-5 Digital Signature Standard. FIPS 140-3 Security Requirements for Cryptographic Modules.
- NIST — SP 800-57 Part 1 Rev. 5, Recommendation for Key Management (generate through destroy).
- NIST — SP 800-207 Zero Trust Architecture — no implicit trust from location.
- ISO/IEC 11889 — Trusted Platform Module. Memory-protection and reference-monitor properties are well-known CBK (Anderson / TCSEC lineage), not an ISC2 percentage claim.
- Well-known CBK (not an ISC2 sub-weight): Clark-Wilson access triple; Brewer-Nash / Chinese Wall; STRIDE; CPTED; fire classes A–D/K; clean-agent vs water vs CO2 in occupied electronics spaces; fail-secure vs fail-safe.
Related: Domain 2 · Asset Security · Domain 4 · Communication and Network Security · All 8 domains map · Domain 3 timed assessment · 8-week roadmap