Domain 3 · Security Architecture and Engineering · Lesson 3 of 8
Design controls around trust boundaries and failure
About 16 minutes · Introductory draft · Checked 2026-10-22
AI editorial review for introductory study; independent review and complete exam alignment remain pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
What you will learn
- Turn security requirements into layered design choices.
- Explain complete mediation, secure failure and separation of duties.
- Distinguish cryptographic properties from key and trust management.
Design before choosing products
Start with the assets, expected users, trust boundaries, misuse cases and failure consequences. Threat modeling asks what could go wrong in a particular design and how requirements will address it. A list of security products does not show whether a sensitive operation is checked at the right boundary.
Least privilege limits authority; separation of duties divides conflicting responsibilities. Complete mediation requires authorization checks for each relevant access rather than assuming that a previous successful check applies forever. Defense in depth uses controls with complementary failure modes, rather than several copies of the same unchecked assumption.
Specify secure behavior under failure
A secure default starts with restricted access until a justified permission is granted. Fail securely means a failure preserves the relevant security requirement. For a remote authorization lookup, silently granting every request after a timeout would usually violate that requirement. Consider caching, availability needs and approved emergency procedures explicitly rather than allowing an accidental fallback.
Physical and environmental design also matters. Power, cooling, fire detection and controlled access support the system’s purpose. Life safety takes precedence in appropriate emergency designs; an exit mechanism may need to permit safe escape even when a computer fails. Explain the protected objective instead of applying one slogan to every kind of failure.
Separate cryptographic goals and dependencies
Encryption supports confidentiality. A hash supports integrity comparisons against a trustworthy expected value. A validated digital signature can support origin and integrity, but does not promise harmless content. Choose approved mechanisms and libraries for the requirement instead of inventing a new algorithm.
Keys and trust relationships need lifecycle management: generation, restricted use, storage, rotation, revocation and recovery where appropriate. A strong cipher does not help if its decryption key is exposed with the data. Formal confidentiality and integrity models, detailed cryptanalysis and engineering tradeoffs require deeper study than this introduction.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
An application grants privileged actions whenever its authorization service times out. A second firewall is proposed as the only fix. What design issue should be addressed first?
Compare your reasoning
The application’s failure behavior grants authority without a successful permission decision. Define a fail-secure authorization path and an explicitly controlled recovery or emergency process that respects business needs. Another firewall may provide a useful layer but does not repair the permission logic at that trust boundary.
Applied study · Added 2026-10-22
Design for failure, mediation and trustworthy cryptography
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: Assume a boundary can fail and minimize its consequences.
Explore the anchors
Limit each component to necessary powers.
Concept matching activity
Match this task or description to its concept:
Use complementary safeguards.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 3.1. Open its full syllabus chapter.
Apply principles at the actual enforcement point
Complete mediation requires checking relevant access requests, including alternate paths. Least privilege limits authority; separation of privilege can require more than one independent condition for a sensitive action. Fail-safe defaults deny access when the system lacks sufficient authorization information, but design must also account for safety and availability requirements. State the intended failure behavior and test it. A security model helps reason about properties; naming a model is not proof that the implementation enforces it.
Protect keys and validate the trust chain
Symmetric encryption commonly protects bulk data, while asymmetric mechanisms support key agreement or signatures depending on the scheme. Hashing is not a substitute for encryption. Security also depends on key generation, storage, access, rotation, backup, revocation and destruction. Validate certificates against the intended identity and use, not merely whether a certificate exists. For future migration, inventory cryptographic dependencies and test compatibility; do not claim that changing one algorithm makes the whole architecture resistant to every future attack.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A document gateway checks permissions on its browser endpoint but not on its export endpoint.
- Both paths return the same protected records.
Your task
- Identify the violated design principle.
- Propose verification beyond the visible interface.
Compare with the model answer
The alternate export path bypasses mediation of the same protected resource. Enforce the authorization decision on every relevant server path and test permitted and denied requests through both endpoints. Include service identities and background jobs in the design review. Hiding the export link does not establish a protected enforcement point.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Remember
- Trace requirements through boundaries, checks and failure paths.
- Choose layers that address different weaknesses.
- Cryptography relies on protected keys and a validated trust model.
Orientation and further reading
Original examples and explanations. Background references do not establish complete exam coverage.