ISSAP

ISSAP Exam Details

Domain Weight Breakdown

ISSAP Certification Path

The ISSAP is one of three CISSP concentration certifications offered by ISC2, alongside the ISSEP (Engineering) and ISSMP (Management). It validates deep expertise in security architecture -- the design and implementation of security solutions that align with business objectives. Unlike the broad CISSP which covers all domains at a managerial level, the ISSAP drills into the architectural specifics of access control systems, cryptographic implementations, network security design, BCP/DRP architecture, and secure telecommunications.

Candidates must hold an active CISSP and demonstrate professional experience in security architecture. The ISSAP is ideal for security architects, chief security architects, and analysts who design enterprise security infrastructure. It proves you can translate business requirements into secure technical architectures using defense-in-depth, zero trust, and risk-based design principles.

Tip: The ISSAP exam heavily tests your ability to SELECT the correct architecture for a given scenario. Focus on understanding WHEN and WHY to choose a specific approach rather than just memorizing definitions.

Security Architecture Frameworks

Security architecture provides a structured approach to designing, implementing, and maintaining security controls across an organization. Multiple frameworks guide this process, and the ISSAP requires understanding when to apply each one.

Tip: SABSA is the only framework designed specifically for security architecture. Zachman and TOGAF are enterprise architecture frameworks that can incorporate security but are not security-specific. Know the distinction.

Defense-in-Depth Architecture

Defense-in-depth is the foundational principle of security architecture. It employs multiple layers of security controls so that if one layer fails, subsequent layers continue to protect the asset. The architecture must address all layers from physical to application.

Zero Trust Architecture (ZTA)

Zero Trust is a security paradigm that eliminates implicit trust and continuously validates every stage of digital interaction. Defined in NIST SP 800-207, it shifts from perimeter-based security to identity-centric, data-centric protection.

• Never Trust, Always Verify: All resources, users, and devices are treated as untrusted regardless of network location
• Least Privilege Access: Access granted on a per-session basis with the minimum permissions required
• Microsegmentation: Network divided into granular zones; lateral movement is restricted by policy
• Continuous Monitoring: Real-time analytics and telemetry to detect anomalies and enforce policy dynamically
• Policy Decision Point (PDP): Central engine evaluating access requests based on identity, device posture, context, and risk
• Policy Enforcement Point (PEP): Gateway or proxy enforcing PDP decisions at the data path

Tip: Zero Trust does NOT mean "deny everything." It means every access request is authenticated, authorized, and encrypted before being granted -- even inside the corporate network.

Threat Modeling Methodologies

Security Architecture Principles

• Least Privilege: Users, processes, and systems receive only the minimum access necessary to perform their function
• Separation of Duties: Critical tasks require multiple individuals to complete, preventing single-point abuse
• Fail Secure: Systems default to a secure state when they fail (deny access, close ports, block traffic)
• Economy of Mechanism: Keep designs as simple as possible to reduce attack surface and audit complexity
• Complete Mediation: Every access to every resource must be checked for authorization (no caching of permissions)
• Open Design: Security should not depend on secrecy of the design (Kerckhoffs' principle)
• Psychological Acceptability: Security mechanisms must not make resources more difficult to access than if they were absent
• Defense in Depth: Multiple overlapping controls at every layer ensure no single point of failure

Network Security Architecture

Infrastructure security architecture encompasses the design of secure network topologies, segmentation strategies, and the selection and placement of security controls throughout the enterprise network.

Access Control Models

Access control is a core domain of the ISSAP. Understanding the differences between access control models and when each is appropriate is critical for architectural decisions.

Tip: MAC is the most restrictive model -- users CANNOT change permissions. DAC is the least restrictive -- owners can delegate access. ABAC is the most flexible and is the model behind most modern cloud IAM systems.

Identity and Access Management (IAM) Architecture

Secure Communications Architecture

Tip: SASE (Secure Access Service Edge) is increasingly tested. It converges networking and security into a cloud service, making it the modern alternative to traditional VPN + on-premises firewall architectures.

Wireless Security Architecture

Cryptographic Architecture

The security architect must design cryptographic implementations that protect data confidentiality, integrity, and authenticity. This includes selecting algorithms, key management strategies, and PKI infrastructure.

Public Key Infrastructure (PKI) Architecture

PKI provides the framework for managing digital certificates and public-key encryption. Proper PKI architecture is essential for TLS, code signing, email encryption, VPN authentication, and document signing.

Tip: The root CA should ALWAYS be offline and air-gapped. A compromised root CA means the entire PKI hierarchy is compromised and must be rebuilt from scratch.

Business Continuity Planning (BCP) Architecture

BCP ensures that critical business functions can continue during and after a disruptive event. The security architect designs the technical infrastructure to support BCP objectives.

Disaster Recovery Site Types

Tip: Cloud DR is increasingly the answer for modern architectures. It provides hot-site-like RTOs at variable cost since you only pay for resources when activated, compared to the constant cost of maintaining a physical hot site.

Data Protection Architecture

• Encryption at Rest: Full-disk encryption (BitLocker, LUKS), database TDE, file-level encryption; protect data stored on disk
• Encryption in Transit: TLS 1.2/1.3, IPSec, SSH tunnels; protect data moving across networks
• Encryption in Use: Homomorphic encryption, secure enclaves (SGX, SEV), confidential computing; protect data during processing
• Tokenization: Replace sensitive data with non-reversible tokens; no key needed to detokenize (uses lookup table)
• Data Masking: Irreversibly alter data for non-production environments (development, testing, analytics)
• DLP (Data Loss Prevention): Monitor, detect, and block unauthorized data exfiltration at endpoint, network, and cloud levels

SOC Architecture

The Security Operations Center (SOC) is the centralized function responsible for monitoring, detecting, analyzing, and responding to security incidents. The security architect designs the SOC technology stack, data flows, and integration points.

Incident Response Architecture

The NIST SP 800-61 incident response lifecycle defines four phases. The security architect must design systems that support each phase with appropriate tools and data flows.

Cloud Security Architecture

Tip: Know the shared responsibility model. In IaaS, you secure everything above the hypervisor. In PaaS, you secure applications and data. In SaaS, you secure data and access configurations only. The CSP handles the rest.

Logging, Monitoring & Forensics Architecture

• Centralized Logging: All logs forwarded to SIEM via syslog, API, or agents; time synchronized via NTP; tamper-evident storage
• Network Monitoring: Full packet capture (PCAP), NetFlow/IPFIX analysis, DNS monitoring, encrypted traffic analytics
• Endpoint Telemetry: EDR sensors, process execution logs, file integrity monitoring (FIM), registry monitoring
• Forensic Readiness: Pre-planned evidence collection procedures, forensic imaging tools, write-blockers, chain of custody forms
• Log Retention: Regulatory requirements drive retention periods (PCI-DSS: 1 year, HIPAA: 6 years, SOX: 7 years)
• UEBA (User Entity Behavior Analytics): ML-based anomaly detection on user and entity behavior baselines

Governance, Risk & Compliance Architecture

Access Control Models Comparison

Symmetric vs Asymmetric Cryptography

Tip: In practice, hybrid encryption is always used. Asymmetric crypto exchanges/agrees on a symmetric session key, then symmetric crypto encrypts the actual data. TLS, IPSec, and PGP all use this hybrid approach.

Security Architecture Frameworks Comparison

DR Site Types Comparison

VPN Technologies Comparison

Authentication Protocols Comparison

Tip: SAML is for authentication (who are you), OAuth is for authorization (what can you access). OpenID Connect adds authentication ON TOP of OAuth 2.0. This distinction is heavily tested.