CompTIA SecurityX (CAS-005)Security EngineeringHard
A security architect is designing a system for a highly sensitive research facility that processes classified data. The system must enforce strict isolation between different security domains, even at the hardware level, to prevent any data leakage or unauthorized access. Which specialized system architecture is MOST appropriate for achieving this level of isolation?
- AHardware-enforced separation (e.g., Multiple Independent Levels of Security/MILS)
- BVirtualization with a Type 2 hypervisor
- CCloud-based multi-tenancy with strong access controls
- DContainerization (e.g., Docker, Kubernetes)
Show answer & explanationAnswer & explanation
Correct answer: A. Hardware-enforced separation (e.g., Multiple Independent Levels of Security/MILS)
Hardware-enforced separation, such as MILS (Multiple Independent Levels of Security), provides the highest degree of isolation by physically or logically segregating components at the silicon level, ensuring distinct security domains cannot interfere with each other. This is crucial for classified environments where even hypervisor-level vulnerabilities are unacceptable.
Why the other options are wrong
- B. Type 2 hypervisors run on top of an existing OS, offering less isolation than Type 1, and both types still have a common hypervisor layer susceptible to shared vulnerabilities.
- C. Cloud-based multi-tenancy inherently involves sharing underlying hardware and hypervisor layers, making it unsuitable for the extreme isolation required for classified data without additional, highly specialized safeguards.
- D. Containerization provides process-level isolation within a shared OS kernel, offering less robust security than hypervisors and significantly less than hardware-enforced separation.
Hardware-Enforced Separation (MILS)
A system architecture that uses hardware mechanisms to create provably isolated partitions, ensuring distinct security domains cannot interfere with each other.
- Highest level of isolation.
- Used for classified or safety-critical systems.
- Prevents side-channel attacks and hypervisor escapes.
Memory trick: For ultimate isolation, hardware is the hardest wall.