Secure Design Principles and Models
Secure design principles
Secure systems are designed, not patched into existence. These principles appear throughout the exam and should shape every architecture you evaluate.
- Least privilege — grant only the access required to do the job.
- Defense in depth — layered, independent controls so one failure is not fatal.
- Fail secure — when a component fails, it must default to a protected state.
- Separation of duties and job rotation — no single person can complete a sensitive process alone.
- Economy of mechanism — keep designs small and simple enough to verify.
- Complete mediation — every access request is checked, every time.
Security models
- Bell-LaPadula — confidentiality. No read up, no write down (the *-property).
- Biba — integrity. No read down, no write up.
- Clark-Wilson — integrity through well-formed transactions and separation of duties.
- Brewer and Nash (Chinese Wall) — dynamically prevents conflicts of interest.
- Non-interference — high-level actions must not be observable to low-level subjects.
Trusted systems
The trusted computing base (TCB) is the total combination of protection mechanisms in a system. The security kernel enforces the reference monitor concept, which must be tamperproof, always invoked, and small enough to be verified. The Common Criteria expresses assurance as Evaluation Assurance Levels EAL1 through EAL7 against a protection profile and security target.
Common architecture flaws
Watch for covert channels (timing and storage), TOCTOU race conditions, maintenance hooks left in production, buffer overflows from missing bounds checks, and side-channel attacks against cryptographic implementations.