Security Architecture · Topic 2 of 7
Technical and Business Design Considerations
Security+ design trade offs: availability, resilience, open source, usability, compute, power, data sovereignty, cost, ownership and scalability.
- 5 min
- Availability is about being up, and resilience is about surviving and recovering from failure.
- Proprietary software depends on a vendor for fixes, while open source code can be inspected by anyone.
- Poor usability leads people to bypass controls.
What it is
No architecture is best in every way. Choosing between cloud, on premises or another model means weighing technical factors, such as availability and compute, against business factors, such as cost and data sovereignty.
Security+ asks you to spot which factor matters most in a scenario. The right answer is the model that best fits the stated priority, not the most secure option in the abstract.
How it works
Technical considerations
| Factor | Question to ask |
|---|---|
| Availability | Must the system be up all the time, and what does downtime cost? |
| Resilience | Can it keep working, or recover, when a part fails or is attacked? |
| Proprietary vs. open source | Who supplies fixes, and can the code be inspected? |
| Usability | Will people use the system as intended, or work around it? |
| Responsibility | Who secures each layer: the organization, a provider or a vendor? |
| Compute | Is there enough processing capacity for the workload and the security tools? |
| Power requirements | How much power does it need, and is backup power available? |
| Ease of recovery | How quickly and simply can service return after a failure? |
Proprietary vs. open source
Proprietary software is owned by a vendor, which controls the code, the fixes and the support. You depend on that vendor to find and patch flaws, and on its contract for support.
Open source software publishes its code, so anyone can inspect it and many people may find flaws. Support may come from a community rather than a contract, and the organization must track updates itself.
Usability and responsibility
Usability is a security factor. If a control is too hard to use, people bypass it, for example by sharing accounts or writing down passwords.
Responsibility means knowing which party secures what. In the cloud this follows the shared responsibility model, and a contract or responsibility matrix should state it clearly.
Compute, power and ease of recovery
Compute and power are physical limits. A small device may not have the processing capacity to run encryption or monitoring agents. A site without backup power fails with the first outage.
Ease of recovery asks how much work it takes to restore service. Designs built from code and automated builds are usually faster to rebuild than systems configured by hand.
Business considerations
| Factor | Question to ask |
|---|---|
| Data sovereignty | Which country's laws apply to the data where it is stored? |
| Data classification | How sensitive is the data, and may it be placed in this model? |
| Cost | What does it cost to build, run and secure over its life? |
| Ownership | Who owns the systems, the data and the decisions? |
| Environmental requirements | Does the site meet the needs for cooling, temperature, space and local rules? |
| Scalability | Can capacity grow or shrink with demand? |
| Risk | What risks does this choice add, remove or move to another party? |
Sovereignty, classification and ownership
Data sovereignty means data is subject to the laws of the country where it is stored. A cloud region in another country can bring different legal duties, so regulated data may have to stay in a set location.
Data classification limits where data may go. Highly classified data may be barred from a public cloud, while public data can go almost anywhere. Ownership decides who is accountable and who may change the systems, which matters when a provider runs them.
Cost, scalability and risk
Cost includes the price of security, staff and support, not only the purchase. Cloud models turn large up front spending into ongoing fees.
Scalability is the ability to adjust capacity as demand changes, and cloud services usually scale faster than on premises hardware. Risk ties the factors together: each choice adds some risks, removes others and may transfer part of the impact to a provider through a contract.
How the exam asks about this
- "Customer records must by law stay inside the country." -> Data sovereignty decides where the data may be hosted.
- "Staff keep writing down the new passwords because the login process is too complex." -> A usability problem that weakens security.
- "A retailer's traffic triples every holiday season." -> Scalability, so an elastic cloud model fits.
What to remember for the exam
- Availability is about being up, and resilience is about surviving and recovering from failure.
- Proprietary software depends on a vendor for fixes, while open source code can be inspected by anyone.
- Poor usability leads people to bypass controls.
- Responsibility must be clear for every layer, especially with a provider.
- Compute and power limits can rule out security software on small devices.
- Data sovereignty ties data to the laws of the country where it is stored.
- Data classification can restrict which architecture may hold the data.
- Scalability is the ability to adjust capacity to demand.
- Moving to a provider transfers some risk, but not accountability for the data.
Read the scenario for its priority word, such as cost, uptime, law or growth. That word usually points to the deciding factor.
Common mistakes
Choosing the most secure option when the question asks for the best fit. If the stated priority is cost or availability, the answer must meet that priority while staying acceptable for security.
Thinking open source is always less secure. Public code can be reviewed by many people, but someone in the organization must still track and apply updates.
Confusing availability with resilience. A system can be available most of the time and still lack a way to recover when it fails.
Ignoring data sovereignty when picking a cloud region. The region decides which laws apply to the data.
Thinking risk transfer removes accountability. A provider may carry part of the impact, but the organization stays accountable for its data.
Do not treat cost as only the purchase price. Running, securing and recovering a system often cost more than buying it.
Check yourself
What is data sovereignty?
The idea that data is subject to the laws of the country where it is stored.
Why is usability a security consideration?
Controls that are hard to use lead people to bypass them, which weakens security.
What does scalability mean in an architecture?
The ability to increase or reduce capacity as demand changes.
Topic 2 of 7 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.