IT Security/Objectives/Security Architecture

< IT Security < Objectives

3.1 Compare and contrast security implications of different architecture models.

  • Architecture and infrastructure concepts
    • Cloud
      • Responsibility matrix
      • Hybrid considerations
      • Third-party vendors
    • Infrastructure as code (IaC)
    • Serverless
    • Microservices
    • Network infrastructure
      • Physical isolation
        • Air-gapped
      • Logical segmentation
      • Software-defined networking (SDN)
    • On-premises
    • Centralized vs. decentralized
    • Containerization
    • Virtualization
    • IoT
    • Industrial control systems (ICS)/ supervisory control and data acquisition (SCADA)
    • Real-time operating system (RTOS)
    • Embedded systems
    • High availability
  • Considerations
    • Availability
    • Resilience
    • Cost
    • Responsiveness
    • Scalability
    • Ease of deployment
    • Risk transference
    • Ease of recovery
    • Patch availability
    • Inability to patch
    • Power
    • Compute

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

  • Infrastructure considerations
    • Device placement
    • Security zones
    • Attack surface
    • Connectivity
    • Failure modes
      • Fail-open
      • Fail-closed
    • Device attribute
      • Active vs. passive
      • Inline vs. tap/monitor
    • Network appliances
      • Jump server
      • Proxy server
      • Intrusion prevention system (IPS)/intrusion detection system (IDS)
      • Load balancer
      • Sensors
    • Port security
      • 802.1X
      • Extensible Authentication Protocol (EAP)
    • Firewall types
      • Web application firewall (WAF)
      • Unified threat management (UTM)
      • Next-generation firewall (NGFW)
      • Layer 4/Layer 7
  • Secure communication/access
    • Virtual private network (VPN)
    • Remote access
    • Tunneling
      • Transport Layer Security (TLS)
      • Internet protocol security (IPSec)
    • Software-defined wide area network (SD-WAN)
    • Secure access service edge (SASE)
  • Selection of effective controls

3.3 Compare and contrast concepts and strategies to protect data.

  • Data types
    • Regulated
    • Trade secret
    • Intellectual property
    • Legal information
    • Financial information
    • Human- and non-human-readable
  • Data classifications
    • Sensitive
    • Confidential
    • Public
    • Restricted
    • Private
    • Critical
  • General data considerations
    • Data states
      • Data at rest
      • Data in transit
      • Data in use
    • Data sovereignty
    • Geolocation
  • Methods to secure data
    • Geographic restrictions
    • Encryption
    • Hashing
    • Masking
    • Tokenization
    • Obfuscation
    • Segmentation
    • Permission restrictions

3.4 Explain the importance of resilience and recovery in security architecture.

  • High availability
    • Load balancing vs. clustering
  • Site considerations
    • Hot
    • Cold
    • Warm
    • Geographic dispersion
  • Platform diversity
  • Multi-cloud systems
  • Continuity of operations
  • Capacity planning
    • People
    • Technology
    • Infrastructure
  • Testing
    • Tabletop exercises
    • Fail over
    • Simulation
    • Parallel processing
  • Backups
    • Onsite/offsite
    • Frequency
    • Encryption
    • Snapshots
    • Recovery
    • Replication
    • Journaling
  • Power
    • Generators
    • Uninterruptible power supply (UPS)

This article is issued from Wikiversity. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.