Security Architecture

Encryption using linked key pairs where what the public key encrypts only the private key can decrypt; slow, so used for key exchange and signatures rather than bulk data.

The confidentiality-only security model behind CISSP Domain 3: No Read Up (Simple Security Property) and No Write Down (Star Property) keep classified data from leaking downward.

The integrity counterpart to Bell-LaPadula: No Read Down and No Write Up stop trusted data from being contaminated by less trustworthy sources. Confidentiality is out of scope.

The Chinese Wall model: access rights change dynamically based on what a user has already accessed, blocking conflicts of interest between competing clients' data.

A commercial integrity model built on well-formed transactions and separation of duties: users change data only through certified programs, never directly. Access triple: subject, program, object.

Layering physical, technical, and administrative controls so no single control failure exposes an asset; every layer assumes the layer in front of it can be breached.

A message hash encrypted with the sender's private key, proving integrity, authenticity, and nonrepudiation to anyone with the matching public key; it provides no confidentiality.

Access controlled at the owner's discretion: whoever owns a resource decides who else may use it. Flexible, but permissions can spread in ways no central policy intended.

A failure mode where a control defaults to denying access when it loses power or malfunctions, protecting the asset; contrast fail safe, which defaults to protecting people.

A security model defining eight primitive protection rights: how subjects and objects are securely created and deleted, and how access rights are granted, transferred, and revoked.

A one-way function condensing any input into a fixed-length digest used to verify integrity; computationally infeasible to reverse, and secure only while collisions stay impractical.

Holding copies of cryptographic keys with a trusted third party so they can be recovered for continuity or produced for lawful access, trading confidentiality risk for availability.

Granting each user, process, or account only the access its task requires, and no more. Limits the damage from mistakes, malware, and compromised credentials alike.

An attack where the adversary secretly relays, and can alter, traffic between two parties who believe they communicate directly; defeated by mutual authentication and certificate validation.

Access decided by the system comparing security labels against clearances, under a policy users cannot override. Not even a file's owner can share it outside policy.

The Bell-LaPadula rule that a subject cannot read data classified above their clearance. Confidentiality's ceiling: a Secret clearance never opens a Top Secret file.

The Bell-LaPadula rule that a subject cannot write to a lower classification level, stopping cleared users from leaking secrets into documents that lower clearances can read.

Authenticating with a stolen password hash instead of the password itself, exploiting NTLM's use of the hash as the credential; no cracking needed, the hash is the secret.

The CAs, registration authorities, certificates, and revocation services (CRLs, OCSP) that bind identities to public keys and let strangers trust asymmetric cryptography at scale.

Splitting a critical process across multiple people so no individual can complete it alone, forcing collusion to commit fraud. A core control in Clark-Wilson and Domain 1 alike.

An attack recovering secrets from an implementation's physical leakage (timing, power draw, emanations, cache behaviour) rather than from any weakness in the algorithm itself.

Encryption where one shared secret key both encrypts and decrypts: fast enough for bulk data, but burdened by the key distribution problem and n(n-1)/2 keys for n parties.

A dedicated hardware chip that stores cryptographic keys, measures boot integrity, and seals secrets to a known-good platform state, anchoring full-disk encryption and secure boot.

A Clark-Wilson concept: data may only be changed by vetted procedures that move it from one consistent state to another, never by direct edits, preserving internal and external consistency.

A security model granting no implicit trust from network location: every request is authenticated, authorised, and continuously verified, wherever it originates.