CompTIA Security+: Security Architecture Concepts

Overview

This chapter covers how systems are designed and placed so they stay secure and keep running. It includes cloud and other architecture models, secure network design, protecting data, and planning for recovery after failures or disasters.

In SaaS the provider delivers finished software, in PaaS it provides a platform to build apps, and in IaaS it provides virtual servers that the customer manages, including the guest operating system. Infrastructure as code defines systems in files so they deploy the same way every time. Industrial control systems run physical processes and are hard to patch, and air-gapped systems have no network connection at all. In virtualization, VM escape is a key risk.

Public servers belong in a screened subnet (DMZ). An IPS sits inline and can block attacks, while an IDS alerts. A fail-closed device blocks traffic when it fails. VPNs create encrypted tunnels for remote users, and zero trust network access gives access to specific applications after checking each user and device. Data can be at rest, in transit, or in use; protection methods include encryption, tokenization (random stand-in values with a secure vault), and masking (hiding part of the data). Data sovereignty means data is subject to the laws of the country where it is stored.

For resilience, a hot site can take over almost immediately, a warm site needs some setup, and a cold site has only space and power. RTO is how fast service must be restored, and RPO is how much data can be lost. To restore from differential backups you need the last full backup and the latest differential. A UPS provides short-term battery power, load balancing spreads traffic across servers, vendor diversity avoids a single shared flaw, and tabletop exercises test plans through discussion.