CISSP Domain 4 Summary

4.0 Implement Secure Design Principles in Network Architectures

Domain 4 begins by establishing how data moves across networks and how security controls align to that movement. The CISSP exam does not test protocol configuration or packet mechanics; it tests your ability to identify where security controls belong, where attacks occur, and which architectural decision best reduces risk.

The OSI and TCP/IP models provide this foundation.

4.0.1 OSI and TCP/IP Models – CISSP Perspective

The OSI and TCP/IP models are conceptual frameworks used to understand network communication. For the CISSP exam, their value lies in risk analysis, control placement, and attack identification, not technical implementation.

Core Networking Concepts (Must-Know)

OSI vs TCP/IP

• OSI Model: Conceptual, security-analysis focused

• TCP/IP Model: Practical, implementation focused

OSI Layers

4.0.2 IP Addressing and Core Network Services

Secure network architecture begins with correct addressing, segmentation, and protection of core network services. For the CISSP exam, the focus is not on memorizing configurations, but on understanding how addressing and services impact security, visibility, and risk containment.

IPv4 vs IPv6 — Security Perspective

The transition from IPv4 to IPv6 was driven by address exhaustion, but it also introduces meaningful security differences that CISSP candidates must understand.

Subnetting — Security and Management Value

Subnetting divides a large network into smaller logical segments.

From a security standpoint, subnetting:

• Limits broadcast traffic, improving performance

• Contains breaches by restricting lateral movement

• Enables security zoning based on role, function, or sensitivity

Network Address Translation (NAT)

NAT translates internal private IP addresses into public IP addresses for external communication. While originally created to conserve IPv4 addresses, it also provides a layer of abstraction between internal networks and the internet.

Types of NAT:

• Static NAT: One-to-one mapping, commonly used for public-facing servers

• Dynamic NAT: Maps internal addresses to a pool of public IPs

• PAT (NAT Overload): Multiple internal hosts share one public IP using port numbers

DNS — A Critical Network Service

The Domain Name System (DNS) translates human-readable names into IP addresses and is foundational to almost all network communication.

Because DNS is trusted by default, it is a high-value attack target.

Common DNS Threats:

• DNS cache poisoning

• DNS amplification attacks

• DNS tunneling

• DNS hijacking / pharming

DNSSEC — Protecting DNS Integrity

DNSSEC enhances DNS by using cryptographic signatures to validate responses.

• Provides integrity and authenticity

• Prevents spoofing and cache poisoning

• Does NOT provide confidentiality

• Does NOT encrypt DNS traffic

DNS Security Best Practices

Effective DNS security relies on architectural controls, not just protocol features.

Key practices include:

• Split-Brain DNS: Separate internal and external DNS zones

• DNSSEC: Sign public DNS zones

• Restricted Zone Transfers: Allow transfers only to authorized secondary servers

• DDoS Protection: Protect public DNS servers from amplification attack

4.0.3 Network Topologies and Architectures

Network topology and architecture decisions directly impact availability, fault tolerance, traffic visibility, and security control placement. For the CISSP exam, the emphasis is on understanding risk exposure and design intent, not physical cabling layouts.

Physical Network Topologies — Security Perspective

Physical topology defines how devices and transmission media are arranged.

• Bus: Shared medium with no isolation; high risk and poor fault tolerance

• Star: Centralized control; failure of the core device affects availability

• Tree: Scalable hierarchical design; increases operational complexity

• Mesh: High redundancy and fault tolerance; expensive and complex

• Ring: Legacy design; single break can disrupt communication

Three-Tier Network Architecture Model

Modern enterprise networks commonly adopt a layered architecture to improve scalability, control, and fault isolation.

• Access Layer:
  Provides connectivity for users and devices. This is where initial access controls such as VLANs and Network Access Control (NAC) are enforced.

• Distribution Layer:
  Acts as the policy enforcement boundary. Performs routing, filtering, and traffic control between access and core layers.

• Core Layer:
  Designed for speed and availability, not inspection. Security filtering should not slow core traffic.

Traffic Flow Analysis

Understanding traffic direction is essential for correct control placement.

• North–South Traffic:
  Traffic entering or leaving the enterprise (e.g., users accessing public services).
  Primary controls: firewalls, gateways, IDS/IPS.

• East–West Traffic:
  Internal traffic within the data center or between internal segments.
  Primary controls: segmentation, internal firewalls, microsegmentation.

4.0.4 Wireless Networking Principles

Wireless networks expand the attack surface by extending access beyond physical boundaries. CISSP focuses on protocol strength, authentication models, and attack recognition.

Wireless Security Protocol Hierarchy

Wireless security protocols have evolved to correct earlier cryptographic failures.

• WEP: Broken and insecure — must never be used

• WPA: Transitional fix using TKIP — deprecated

• WPA2: Long-standing enterprise standard

• WPA3: Current best practice with stronger protection against offline attacks

Common Wireless Attacks and Defenses

4.1 Secure Network Components

Secure network components form the first and most visible line of defense in enterprise architectures. CISSP evaluates your ability to select the right control for the right location, not your ability to configure devices.

Perimeter and Internal Defense Strategies

Enterprise network defense relies on layered architectural controls that limit exposure, reduce blast radius, and enforce security policy consistently.

Core Defense Concepts

• Defense in Depth:
  Uses multiple overlapping administrative, technical, and physical controls so that failure of one layer does not result in compromise.

• Perimeter Defense:
  Focuses on controlling ingress and egress at the network edge where inspection, filtering, and policy enforcement occur.

• Demilitarized Zone (DMZ):
  A segmented buffer network hosting public-facing services (web, mail, DNS) to protect the internal trusted network.

• Bastion Host:
  A hardened system placed at the perimeter or DMZ, designed to run a single critical service and withstand attack.

• Network Segmentation:
  Divides networks into isolated zones to restrict lateral movement using physical or logical separation (VLANs, subnets).

• Microsegmentation:
  Provides workload-level isolation and is a key Zero Trust control to restrict unnecessary east–west traffic.

Firewall Technologies — Conceptual Comparison

Firewalls enforce network security policy by filtering traffic between trust boundaries. CISSP focuses on capability, scope, and placement, not configuration.

• Packet Filtering (Layer 3):
  Stateless filtering based on IP and ports; fast but easily spoofed.

• Stateful Inspection (Layer 4):
  Tracks connection state; more intelligent filtering without payload inspection.

• Circuit-Level Gateway (Layer 5):
  Validates session establishment (e.g., TCP handshake) without inspecting content.

• Application Proxy Firewall (Layer 7):
  Terminates connections and inspects payloads; granular but resource-intensive.

• Next-Generation Firewall (NGFW):
  Combines stateful inspection, deep packet inspection, IPS, and application awareness.

Firewall Rule Management Principles

Effective firewall security depends on disciplined rule management.

• Default deny (whitelisting)

• Most specific rules evaluated first

• Regular audits and cleanup

• Removal of obsolete rules

• Formal change management for all updates

Intrusion Detection, Prevention, and Deception

IDS vs IPS

• IDS: Passive, detects and alerts only

• IPS: Inline, actively blocks malicious traffic

Detection Methods

• Signature-based: Accurate for known attacks, blind to zero-days

• Anomaly-based: Detects unknown attacks but prone to false positives

Alert Accuracy

• True Positive: Correct detection

• True Negative: Correct ignore

• False Positive: Benign flagged as attack

• False Negative: Attack missed (most dangerous)

Honeypots and Honeynets

Honeypots and honeynets are deception-based detective controls designed to attract attackers and study their behavior.

• Honeypot: Single decoy system

• Honeynet: Network of decoys

They contain no production data and serve as early-warning and intelligence tools.

• Enticement (Legal): Making a vulnerable system available

• Entrapment (Illegal): Actively luring someone to commit a crime

4.1.1 Endpoint and Access Control

Endpoint and access control mechanisms ensure that only authorized, trusted, and compliant devices are allowed to access network resources. CISSP evaluates your ability to select the right access control strategy, not configure endpoint tools.

Network Access Control (NAC)

Network Access Control (NAC) is a policy-driven framework that enforces access decisions based on identity and device posture. It integrates authentication, endpoint compliance checks, and network enforcement to prevent untrusted devices from accessing the network.

NAC commonly relies on IEEE 802.1X for port-based authentication and evaluates endpoints before granting access.

Access Decision Logic

• Authenticated & Compliant: Full network access

• Authenticated but Non-Compliant: Restricted or quarantine access for remediation

• Authentication Failure: Access denied

Endpoint Security Controls

Endpoints are frequent attack targets and must be protected with layered host-level controls.

• Antimalware: Detects and blocks malicious software

• Host-Based Firewall / IDPS: Controls inbound and outbound traffic at the device level

• Data Loss Prevention (DLP): Prevents unauthorized data exfiltration

• Endpoint Detection and Response (EDR): Provides behavioral analysis, threat hunting, and rapid response beyond traditional antivirus

Mobile Device Management (MDM) and MAM

Mobile devices extend the network perimeter and require centralized control.

• MDM: Manages and secures the entire device (encryption, passwords, remote wipe, app control)

• MAM: Secures only corporate applications and data, commonly used in BYOD environments

4.2 Implement Secure Communication Channels

Secure communication channels protect data as it traverses untrusted networks, such as the public internet. CISSP evaluates your ability to select appropriate protocols and architectures that ensure confidentiality, integrity, and authenticity for data in transit.

Remote Access and Tunneling Concepts

Remote users commonly access enterprise resources over untrusted networks, making encrypted tunnels essential.

A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network. The underlying mechanism is tunneling, which encapsulates one protocol inside another. Tunneling alone provides transport, not security — encryption and authentication must be added to make the channel secure.

IPsec Modes of Operation

IPsec is a primary VPN technology and operates in two modes:

• Transport Mode:
  Encrypts only the payload. Used for host-to-host communication within trusted environments.

• Tunnel Mode:
  Encrypts the entire original packet and encapsulates it in a new one. Used for site-to-site and remote-access VPNs across untrusted networks.

VPN Traffic Routing Decisions

When implementing remote access VPNs, traffic routing impacts both security and performance.

• Full Tunnel:
  All traffic flows through the VPN. More secure, but higher bandwidth and latency impact.

• Split Tunnel:
  Only corporate traffic uses the VPN. Better performance, but higher risk due to bypassed security controls.

IPsec Security Components (Conceptual)

IPsec uses multiple components to secure traffic:

• Authentication Header (AH):
  Provides integrity and authentication only. No encryption.

• Encapsulating Security Payload (ESP):
  Provides confidentiality, integrity, and authentication. Most commonly used.

• Security Association (SA):
  Defines the parameters of protection. One-way; two are required for full communication.

• Internet Key Exchange (IKE):
  Automates key negotiation and SA creation.

SSL/TLS Secure Communication

TLS (the successor to SSL) provides secure client-to-server communication and is widely used for HTTPS, email, and application services.

TLS uses asymmetric cryptography to establish trust and exchange keys, then switches to symmetric encryption for performance during the session.

Secure Shell (SSH)

SSH provides a secure alternative to Telnet for remote system access.

It ensures:

• Encrypted communication

• Strong authentication

• Integrity protection

• Secure tunneling of other protocols

Email Security Protocols

Email lacks built-in authentication, making spoofing and phishing common threats. Three protocols work together to address this risk:

• SPF: Verifies authorized sending servers

• DKIM: Verifies message integrity and sender authenticity

• DMARC: Defines enforcement policy and reporting