Security Architecture and Engineering · Topic 3 of 8
Control Selection and System Security Capabilities
Selecting controls from system security requirements, evaluation criteria such as Common Criteria, and capabilities like memory protection, TPM, HSM and encryption.
- 3 min
- Controls come from requirements: classification, law, contract, risk.
- Common Criteria: PP (buyer's needs), ST (vendor's claims), TOE (the product), EAL1 to EAL7 (assurance depth).
- Certification evaluates; accreditation authorizes.
What it is
Controls should be chosen from the system's security requirements, not from habit. Those requirements come from the data's classification, laws, contracts and risk assessment. Systems also have built-in security capabilities in hardware and firmware that architects should understand and use.
How it works
Selecting controls
- Identify requirements: confidentiality, integrity and availability needs; legal and contractual obligations; risk assessment results.
- Start from a baseline (for example NIST SP 800-53 or ISO/IEC 27002).
- Scope and tailor to the system.
- Where a requirement cannot be met directly, define compensating controls that meet its intent, with the risk owner's approval.
- Verify the controls work, then authorize the system.
Evaluation and assurance
| Concept | Meaning |
|---|---|
| Common Criteria (ISO/IEC 15408) | International framework for evaluating products |
| Protection Profile (PP) | Security requirements for a category of product, written from the buyer's view |
| Security Target (ST) | The vendor's claims for a specific product |
| Target of Evaluation (TOE) | The product being evaluated |
| Evaluation Assurance Levels (EAL1 to EAL7) | How thoroughly the product was tested, from functionally tested (EAL1) to formally verified design and tested (EAL7) |
A higher EAL means more rigorous evaluation, not necessarily more features.
Certification is the technical evaluation of a system's controls; accreditation (authorization) is management's formal decision to accept the residual risk and operate it.
System security capabilities
| Capability | What it does |
|---|---|
| Memory protection | Keeps processes from reading or writing each other's memory |
| Process isolation and protection rings | Separates kernel (ring 0) from user processes (ring 3) |
| Trusted Platform Module (TPM) | Chip that stores keys, measures boot components and supports full-disk encryption and attestation |
| Hardware security module (HSM) | Tamper-resistant device that generates and stores keys and performs cryptographic operations |
| Secure boot and measured boot | Only signed boot components run; measurements are recorded for attestation |
| Encryption and decryption | Built into storage, processors and network devices |
| Trusted execution environment | Isolated area of a processor protecting code and data in use |
| Virtualization and hypervisors | Isolate guest systems from each other |
| Interfaces | Restricted interfaces limit what users can do |
| Fault tolerance | Redundant components keep the system running after a failure |
A TPM is built into one device's motherboard. An HSM is a dedicated appliance or card that serves many systems and is typically used for high-value keys such as certificate authority keys.
Compensating controls in practice
Legacy point-of-sale terminals cannot encrypt stored card data and the vendor will not update them. Isolate them on their own segment, monitor access closely and restrict what they can reach, document the compensating controls against the requirement's intent, and have the risk owner approve until replacement.
How the exam asks about this
- "Which document describes the vendor's security claims for a product?" The Security Target.
- "Which component stores keys on the motherboard and measures boot?" The TPM.
- "A requirement cannot be met by legacy systems." Compensating controls approved by the risk owner.
What to remember for the exam
- Controls come from requirements: classification, law, contract, risk.
- Common Criteria: PP (buyer's needs), ST (vendor's claims), TOE (the product), EAL1 to EAL7 (assurance depth).
- Certification evaluates; accreditation authorizes.
- TPM in each device; HSM for enterprise key protection.
- Compensating controls meet a requirement's intent when the original cannot be applied.
An EAL rating says how thoroughly a product was evaluated against its Security Target, not that it is secure in your environment.
Common mistakes
Confusing certification with accreditation.
Assuming a high EAL means more security functions.
Scoping out a requirement instead of compensating for it.
Check yourself
In Common Criteria, what is a Protection Profile?
A set of security requirements for a category of product, written from the consumer's point of view.
What is the difference between certification and accreditation?
Certification is the technical evaluation; accreditation is management's decision to accept the risk and operate.
What does a TPM provide?
Secure key storage and boot measurement on a single device.
Topic 3 of 8 in Security Architecture and Engineering
Test yourself on Security Architecture and Engineering
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.