Cybersecurity Domain 2

Information Security (InfoSec) Architecture

Detailed study of data governance, the CIA Triad, Parkerian Hexad, access control models (RBAC/ABAC), cryptography, and compliance frameworks.

1. Core Principles: The CIA Triad & Parkerian Hexad

Information Security (InfoSec) focuses on protecting sensitive organizational data across physical, digital, and cloud environments. It guarantees that information assets are guarded against unauthorized access, alteration, or destruction.

Confidentiality

Restricting data access to authenticated & authorized users. Enforced via AES-256 encryption, access control lists (ACLs), and MFA.

Integrity

Ensuring data remains unmodified and authentic. Enforced via SHA-256 cryptographic hashing, HMACs, and digital signatures.

Availability

Guaranteeing timely system & data access. Enforced via redundant clustering, load balancing, and anti-DDoS architectures.

2. Information Classification & Governance

Not all data requires equal security controls. Organizations classify data into tiers based on sensitivity and business risk:

Public: Data designated for public consumption (marketing, public disclosures). Minimal protection required.
Internal Use: Operational data whose disclosure causes low impact (internal policies, org charts).
Confidential: Sensitive business data (financial reports, source code, customer PII). Requires encryption & RBAC.
Restricted / Top Secret: Highly critical assets (trade secrets, cryptographic private keys, regulated health records). Requires HSM protection and explicit executive authorization.

3. Access Control Models

Access control mechanisms specify how subjects (users, services) interact with objects (files, databases, APIs):

1. DAC (Discretionary Access Control):
   - Asset owner specifies permission settings (e.g., POSIX file permissions: chmod 755).

2. MAC (Mandatory Access Control):
   - Strict security labels enforced by OS kernel (e.g., SELinux, AppArmor, Bell-LaPadula model).

3. RBAC (Role-Based Access Control):
   - Permissions assigned to roles (e.g., Admin, Auditor, Developer) rather than individual accounts.

4. ABAC (Attribute-Based Access Control):
   - Fine-grained policies evaluated dynamically based on Subject, Resource, Action, and Environment attributes (e.g., AWS IAM condition keys).
      

4. Data Lifecycle States & Cryptographic Controls

Data exists in three primary states, each requiring tailored defense controls:

Data at Rest: Data stored in databases, SANs, or NVMe SSDs. Protected via Full Disk Encryption (FDE/LUKS), database-level TDE (Transparent Data Encryption), and AWS KMS key management.
Data in Transit: Data moving across local networks or the Internet. Protected via TLS 1.3, SSHv2, and IPsec VPNs.
Data in Use: Data actively processed in CPU cache or RAM. Protected via Enclave Cryptography / Confidential Computing (AMD SEV, Intel SGX) and Homomorphic Encryption.

5. International Compliance & Standards

ISO/IEC 27001:2022: The international benchmark for Information Security Management Systems (ISMS).
NIST SP 800-53: Comprehensive security & privacy controls for federal and enterprise systems.
SOC 2 Type II: Independent audit report evaluating Security, Availability, Processing Integrity, Confidentiality, and Privacy.
GDPR & PDPA: Stringent regulatory privacy standards enforcing user data protection and breach notification mandates.