CISSP 9.3 - Assess & Mitigate Vulnerabilities of Security Architectures (Part 1 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens the assess and mitigate vulnerabilities topic in Domain 3 at the ground floor of computer architecture. It digs into the hardware and execution foundations of secure systems, where the highest-level controls eventually rest and where unbypassable security either lives or dies.

Frequently Asked Questions

Why does complexity weaken security?

More moving parts means more places for flaws to hide. Every added component is another surface to secure and another spot where a vulnerability can slip in. As the count of weaknesses and threats climbs, the assurance the system offers drops, so the simpler the design, the more confidence you can place in it. Think of a house with one door versus one with fifty, where every extra door is one more lock to check and one more way in.

What is the processor, and what does it really do?

The processor is the nerve center that governs every major operation in the machine, performing or coordinating the calculations that let the system work. It only understands a small, fixed set of simple operations, and the operating system, compilers, and interpreters translate rich, high-level code down into those bare instructions. That narrow instruction set is deliberate, because it lets the chip run at blazing speed, like a conductor who knows only a handful of hand signals yet directs a whole orchestra.

How do systems do many things at once?

Several distinct techniques share that goal. Multitasking has one core rapidly juggle tasks so only one truly runs at any instant, while multicore uses many independent cores that genuinely run at the same moment. Multiprocessing harnesses more than one processor for a multithreaded application and may pin a task to a core through affinity. Multiprogramming batches tasks on one processor so the next steps in when one waits, and multithreading runs several cheaper-to-switch threads inside one process.

How do protection rings insulate the operating system?

Protection rings sort code into concentric rings by privilege, with the innermost ring holding the most power. Most modern systems use four rings, numbered zero through three, where ring zero is the kernel that can reach any resource, the next rings hold other operating system components and drivers, and user programs sit in the outermost ring. Outer-ring code cannot just grab what it wants, it must ask a lower ring through a system call that checks its credentials, and many systems collapse this into kernel mode and user mode.

What states does a process pass through as it runs?

A process moves through a defined life cycle scheduled by priority within a queue. In the ready state it waits, prepared to run the moment a processor frees up. In the running state, also called the problem state, it executes until it finishes, its time slice expires, or it blocks. In the waiting state it pauses for input or output, the supervisory state kicks in when it needs elevated privileges, and in the stopped state it has finished or been terminated so the operating system reclaims its memory.

Reference: This article is based on concepts discussed in CISSP 9.3 - Assess & Mitigate Vulnerabilities of Security Architectures (Part 1 of 3).