✳ Learning path / 11 lessons
Security architecture, cryptography, and governance
Eleven lessons take an individual contributor from governance hierarchy, legal compliance, quantitative risk math, and data lifecycle engineering through formal state-machine models, hardware TCB isolation, cryptography, PKI, and physical facility defense.
Work through the lessons in order to build a complete engineering mental model, or jump straight to the topic you are designing or reviewing today.
01Security governance and the policy hierarchy
Executive leadership sets risk appetite and signs the top-level security policy. Mandatory standards and baselines translate policy into rules, mandatory procedures spell out steps, and guidelines offer recommended advice.
Law, ethics, and personnel security
Criminal, civil, and administrative law set external boundaries. The ISC2 Code of Ethics orders four mandatory canons. Personnel controls govern hiring, onboarding, rotation, and termination.
Quantitative risk and BIA math: SLE, ALE, RTO, and RPO
Quantitative risk analysis calculates Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), Annualized Loss Expectancy (ALE), and safeguard value. Business Impact Analysis (BIA) pairs financial metrics with MTD, RTO, RPO, and WRT.
Data lifecycle, classification, and governance roles
Data moves through six lifecycle phases from creation to destruction. Classification labels drive baseline controls, while Data Owners, Controllers, Processors, and Custodians hold distinct accountabilities.
Data remanence, retention, and NIST SP 800-88 sanitization
Deleting a file pointer leaves residual physical representation (data remanence). NIST SP 800-88 defines Clear, Purge, and Destroy across magnetic, SSD flash, and cloud storage, paired with legal retention and crypto-shredding.
Formal security models: Bell-LaPadula, Biba, Clark-Wilson, and Brewer-Nash
State machine models enforce security invariants across every transition. Bell-LaPadula protects confidentiality, Biba and Clark-Wilson protect integrity, and Brewer-Nash dynamically prevents conflict of interest.
Secure hardware, TCB, OS rings, and virtualization
The Trusted Computing Base (TCB) and Reference Monitor enforce hardware and kernel isolation. TPM, HSM, CPU protection rings, ASLR/DEP, and Type 1 vs Type 2 hypervisors defend against privilege escalation and side channels.
Symmetric and asymmetric cryptography: ciphers, modes, and hybrid envelopes
Kerckhoffs’s principle holds that security resides in the key, not algorithm secrecy. Compare symmetric block/stream ciphers and AEAD modes (GCM vs ECB) with asymmetric RSA/ECC and post-quantum NIST standards.
Hashing, HMAC, digital signatures, and PKI lifecycle
Cryptographic hashes (SHA-2, SHA-3) verify integrity, HMAC adds shared-secret authenticity, and digital signatures provide non-repudiation. Public Key Infrastructure (PKI) binds identities to public keys via X.509 certificates, CRLs, OCSP stapling, and mTLS.
Physical and facility security: CPTED, mantraps, and access zones
Physical security is the bedrock of logical security. Site selection, Crime Prevention Through Environmental Design (CPTED), layered perimeter controls, mantraps, Faraday cages, and visitor controls protect hardware and human life.
Environmental controls: HVAC, power anomalies, and fire suppression
Datacenter resilience depends on ASHRAE temperature and humidity ranges, hot/cold aisle containment, UPS and generator power conditioning, fire classes (A/B/C/D/K), pre-action sprinkler pipes, and clean-agent gas suppression.
Test your engineering judgment
Every lesson closes with a 4-choice scenario check modeled on real architectural trade-offs. Ready for full hands-on simulations or certification drills?
Open the practice labs ↗ · Launch the CISSP practice simulator ↗