Security Architecture Flashcards

A CISO is evaluating a proposed microservices architecture for a financial application. Which security concern is MOST unique to microservices compared to monolithic architectures?

Answer: Securing a dramatically increased number of inter-service API communication channels

Microservices architectures dramatically increase the attack surface through numerous inter-service API calls that each require authentication, encryption, and authorization controls.

Which architectural framework defines security requirements across five concurrent viewpoints: security architecture, security processes, security technology, security assurance, and security governance?

Answer: SABSA (Sherwood Applied Business Security Architecture)

SABSA is a framework for developing risk-driven enterprise security architectures that links business requirements to security architecture through multiple layered viewpoints.

In network security architecture, what does 'east-west traffic' refer to, and why is it a growing concern?

Answer: Lateral traffic between servers within the same data center or cloud environment

East-west traffic refers to lateral communication between workloads within the same environment; it is a concern because attackers who breach the perimeter can move laterally without being detected by perimeter controls.

A CISO needs to secure a SCADA/ICS environment. Which architectural principle is MOST critical when integrating ICS with corporate IT networks?

Answer: Network segmentation with strict access controls and unidirectional security gateways where possible

ICS/SCADA environments require strict network segmentation from corporate IT networks, often using unidirectional data diodes, because these systems prioritize availability over confidentiality and cannot tolerate standard IT security disruptions.

What is the security implication of using a shared responsibility model in cloud computing?

Answer: Security responsibilities are divided between the cloud provider and customer based on the service model (IaaS, PaaS, SaaS)

The shared responsibility model means security duties are split between the cloud provider (infrastructure, physical) and the customer (data, access controls, configurations) based on the service model used.

Which cryptographic architecture concept ensures that compromising a long-term key does not expose previously recorded encrypted sessions?

Answer: Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy generates ephemeral session keys that are discarded after each session, ensuring that compromise of the long-term private key cannot be used to decrypt previously captured traffic.

A CISO is reviewing a proposed architecture for a high-security environment handling classified data. Which architectural control ensures data cannot flow from a high-security domain to a lower-security domain?

Answer: Data diode (unidirectional security gateway)

A data diode is a hardware-enforced unidirectional device that physically permits data to flow in only one direction, preventing any data leakage from high to low security domains.