Security Architecture and Vulnerability Assessment

Defense in Depth

Do not hang the whole defense on one control:

1

Physical

2

network edge

3

internal network

4

host

5

application

6

data

If one layer fails, the next still has work to do.

---

Control Types

By purpose:

• Preventive: stop the event. Firewall, encryption, access control
• Detective: notice it. SIEM, IDS, audit logs
• Corrective: fix after. Patch, restore from backup
• Deterrent: raise the cost of trying. Signs, visible cameras

By implementation:

• Administrative: policy, procedure, training
• Technical: firewall, crypto, IDS
• Physical: locks, guards, mantraps

---

Architecture Models

Bell-LaPadula: confidentiality. No write up, no read down (military labels).

Biba: integrity. No read up, no write down.

Clark-Wilson: integrity via user → program → data (constrained access).

Brewer-Nash (Chinese Wall): conflict of interest. Block concurrent access to competing clients.

---

Vulnerability Assessment vs Penetration Testing

Vulnerability scanning: automated check for known issues (Nessus, OpenVAS).

Penetration testing: authorized attacker simulation, including manual work.

Type	Prior knowledge	Character
White box	Full	Thorough, internal
Gray box	Partial	Balanced
Black box	None	External attacker view

Pentest stages (authorized scope only):

1. Reconnaissance
2. Scanning
3. Exploitation of a found weakness
4. Privilege change
5. Lateral movement
6. Evidence for the report
7. Report

This is a process list for the exam, not instructions to run against a live system.

---

Series Map

Domain	Core ideas
Security and risk	CIA, risk, compliance
Asset security	Classification, data life cycle
Security architecture	Defense in depth, models
Network security	Firewall, VPN, Zero Trust
IAM	Access control, MFA, PAM
Security assessment	Scanning, pentest
Security operations	IR, BCP/DRP, SIEM
Software security	SDLC, OWASP, secure coding

---

Key Concept Cards

Defense in depth ★★★★★
: Several layers. One control failing is not the end.

Prevent / detect / correct / deter ★★★★★
: Four purposes. The exam asks you to pick the type that fits the story.

Pentest types ★★★★☆
: Black box = outside view. White box = fullest internal test.

---

Practice Quiz

Q1. A firewall is which control type (purpose + implementation)?

Purpose: preventive — it blocks unauthorized traffic before it lands. Implementation: technical. Contrast with security training (administrative + preventive) or CCTV (physical + detective).

Q2. Why does Bell-LaPadula fit a military environment?

It is built for confidentiality. No-read-up keeps lower clearance off higher labels. No-write-down stops a high label leaking into a low one. Military systems rank secrecy first, so this model matches.