CISSP 9.7 - Distributed Systems

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series studies systems that behave as one but are made of many, continuing Domain 3. So much of what you protect is no longer a single box — the pieces live on separate systems, sometimes across continents, and in a distributed world the connections between them are the attack surface.

Frequently Asked Questions

What is a distributed computing environment?

It is a collection of individual systems working together to deliver one service, so users perceive a single entity rather than many separate servers. These environments coordinate their members toward a shared goal and are built for resilience, reliability, performance, and scalability, often tolerating the failure of individual parts. They come in several shapes, from classic client-server, to layered web architectures with multiple tiers, to peer-to-peer designs like file-sharing networks and blockchain ledgers.

What everyday technologies rely on distributed computing?

Far more than most people realize. The backbone of the modern internet leans on this model, including name resolution, single sign-on, directory services, mobile networks, massively multiplayer games, and most of the websites you touch daily. It also makes possible advanced designs like service-oriented architecture, software-defined networking, and microservices.

How do the parts of a distributed system communicate?

Through an interface definition language, a neutral way to describe how client and server components talk to one another. Its power is that it is independent of both programming language and physical location, so objects written in different languages and running in different places can still connect. Several well-known frameworks provide this kind of glue.

What makes a distributed system especially risky?

The very interconnectedness that gives it power. Because the components are tightly linked, an error or a piece of malware can propagate from one part to the next, and an attacker who compromises a single component can pivot and move laterally to reach the others. On top of that sit familiar dangers magnified here: unauthorized access, impersonation and spoofing, bypassed controls, eavesdropping, weak authentication, and gaps in monitoring, logging, and accountability.

How do you actually secure a distributed system?

Start by respecting the enlarged attack surface: weigh the threats to each component and to every connection between them. Encryption is essential across storage, transmission, and even processing, and strong multi-factor authentication should be the norm. Watch out for heterogeneity, since a mix of operating systems and patch levels multiplies configuration and monitoring work, and if the environment sprawls across national borders, fold in data sovereignty, because the laws of each country reach the data that lands there.

Reference: This article is based on concepts discussed in CISSP 9.7 - Distributed Systems.