Core: Security

Security design fundamentals - CIA and defense in depth

Miro Kosut

Miro Kosut

— 1 min read
Share

In one line

Security is a design constraint applied in layers, not a bolt-on - every design choice is weighed against confidentiality, integrity, and availability (CIA).

The frame

  • CIA triad - the lens for every requirement: keep data secret (C), unaltered (I), and reachable (A). They trade off (e.g., inline IPS adds protection but a failure/latency point against A).
  • Defense in depth - no single control is trusted; layer device hardening, segmentation, access control, perimeter, and monitoring so one failure isn't fatal.
  • Attack surface / least privilege - minimise exposure; grant the least access that works. This is the seed of zero trust (Zero Trust and ZTNA).
  • Compliance - regulations (as provided in a scenario) become hard requirements (data locality, encryption, audit) that shape placement and design.

Why it matters for design

The CCDE expects security woven through the architecture: segmentation (Infrastructure segmentation), encryption (Transport security and encrypted-traffic implications), hardened infrastructure (Infrastructure hardening - control, management, and data plane), and identity. Ask of every element: what does this protect (C/I/A), and what does it cost the other two?

IPv6 / dual-stack note

Security must be equal across v4 and v6 - a common gap is hardening/ACLs/monitoring applied only to v4 while v6 rides unprotected.

Spaced repetition

Expand the CIA triad and give the design tension.

Confidentiality, Integrity, Availability - controls that boost one (e.g., inline IPS for C/I) can cost another (availability/latency).

Defense in depth means [...]; least privilege seeds [...].

Defense in depth means layering independent controls so no single failure is fatal; least privilege seeds zero trust.

A frequent dual-stack security gap is [...].

A frequent dual-stack security gap is hardening/ACLs/monitoring applied to IPv4 only, leaving IPv6 unprotected.

Sources

  • Cisco Press, CCNP/CCIE Security Core (SCOR); The Art of Network Architecture.

domain: Core · blueprint-ref: Core 6.0 Security (framing) / Exam-Topics 5.0 Security Design · type: concept · status: complete · tags: [core, core/security, tradeoff/security, tradeoff/complexity]

Read more