Security Design
What this lens evaluates
Whether security is woven through every layer of the design - identity, segmentation, perimeter, hardening, and compliance - rather than bolted on at the edge. Security is risk- and compliance-driven, and it touches every other lens.
The questions it forces
- What is the threat model and the compliance/regulatory obligation?
- Is there defense in depth (control, management, data planes hardened)?
- Are identity and access (AAA/NAC) and segmentation/zero trust designed in?
- How is the perimeter protected, and threats detected/mitigated?
Core considerations
- Fundamentals / CIA / defense in depth -> Security design fundamentals - CIA and defense in depth.
- Hardening -> Infrastructure hardening - control, management, and data plane, Securing routing protocols, Layer 2 security.
- Identity / NAC -> AAA and identity - RADIUS, TACACS+, 802.1X, Network access control and segmentation - NAC, TrustSec, guest and BYOD.
- Segmentation / zero trust -> Zero Trust and ZTNA, Infrastructure segmentation.
- Perimeter / threat -> Perimeter security - firewalls and IPS-IDS, Threat detection and mitigation - DDoS, spoofing, MITM.
- Secure transport -> MACsec and secure transport, Transport security and encrypted-traffic implications.
The AI/ML angle (Exam Topics 5.1.g)
AI changes the security policy: corporate IP-leakage risk via external AI services (Regulations, governance, and AI security policy), the un-inspectable lossless fabric that must be isolated rather than firewalled inline (Securing the high-performance fabric), and hosting-model posture (AI security design and hosting models - air-gapped, private, public).
Compliance frameworks and security models
Name the regimes that become hard constraints when present: HIPAA (health), PCI DSS (cardholder data), GDPR (EU personal data), and data sovereignty/residency (Data sovereignty and data gravity). The Cert Guide frames three security models - perimeter, session/transaction-based, and Zero Trust Architecture - with ZTA as the direction of travel, reached by a staged migration (identify -> segment -> enforce -> verify) rather than a flag day (Zero Trust and ZTNA).
Thinking models: the OODA loop and brittleness
Two models sharpen security design, not just control selection. The OODA loop - Observe, Orient, Decide, Act - frames defense as a race of loops: the defender wins by shortening their own loop and lengthening the attacker's. Designing for OODA means pre-positioning: the monitoring points, telemetry, and playbooks are staged before any incident (Observe and Orient feed on Threat detection and mitigation - DDoS, spoofing, MITM and the telemetry pipeline of Telemetry-driven and closed-loop automation; Act is fast when segmentation provides clean containment switches to pull). The second model is brittleness: a maximally hardened, fully automated defense that cannot adapt tends to fail catastrophically instead of degrading - so design security to bend: keep graceful-degradation paths, keep human judgment in the loop at high-blast-radius decision points, and reuse the network's natural defenses - modularity and resilience - as security containment, because blast-radius thinking applies to a breach exactly as it applies to a fault (Zero Trust and ZTNA).
How it shows up in a scenario
Security requirements (compliance, zero trust, segmentation) appear throughout the brief and must be integrated into every other lens - the network, service, and operational designs each carry their security implications.
Tip: Scenario reflex
Make controls proportional to the data's sensitivity and the stated compliance need. Gold-plating security - or adding a control that breaks the design, such as inline inspection on a lossless fabric (Securing the high-performance fabric) - is a wrong answer. Match the control to the requirement and the threat model.
Spaced repetition
Why can adding more security be a wrong CCDE answer?
Controls must be proportional to data sensitivity and compliance need - gold-plating, or a control that breaks the design (e.g., inline inspection on a lossless RDMA fabric), is penalised; match control to requirement and threat model.
What is the defining principle of the Security Design lens?
Security is woven through every layer (defense in depth), risk- and compliance-driven - not bolted on at the perimeter.
The AI-specific security-design twist is [...] and [...].
The AI-specific security-design twist is you can't inspect the lossless fabric inline, so isolate + edge-enforce + encrypt (MACsec) and govern IP leakage to external AI services.
Identity, segmentation, hardening, and perimeter are not separate tasks but [...].
Identity, segmentation, hardening, and perimeter are not separate tasks but layers of one defense-in-depth design that touches every other lens.
Name the compliance regimes that commonly become hard design constraints.
HIPAA (health), PCI DSS (cardholder data), GDPR (EU personal data), and data-sovereignty/residency law.
The three security models in the Cert Guide are [...] - with ZTA reached by staged migration, not a flag day.
The three security models in the Cert Guide are perimeter, session/transaction-based, and Zero Trust Architecture - with ZTA reached by staged migration, not a flag day.
How does the OODA loop translate into security design, and what is brittleness?
Shorten the defender's Observe-Orient-Decide-Act loop (pre-positioned visibility, telemetry, playbooks, containment switches) while lengthening the attacker's; brittleness is the failure mode of over-hardened fully automated defense - it shatters instead of degrading - so keep graceful degradation and human judgment at high-blast-radius points.
Sources
- Cisco CCDE v3.1 Unified Exam Topics (Domain 5).