2 cissp ® Official Study Guide Eighth Edition

Methods of Securing Embedded and Static Systems
Security concerns regarding embedded and static systems include the fact that most are 
designed with a focus on minimizing costs and extraneous features. This often leads to a 
lack of security and difficulty with upgrades or patches. Because an embedded system is in 

---

378
Chapter 9 
■
Security Vulnerabilities, Threats, and Countermeasures
control of a mechanism in the physical world, a security breach could cause harm to people 
and property.
Static environments, embedded systems, and other limited or single-purpose comput-
ing environments need security management. Although they may not have as broad an 
attack surface and aren’t exposed to as many risks as a general-purpose computer, they still 
require proper security government.
Network Segmentation
Network segmentation
involves controlling traffic among networked devices. Complete or 
physical network segmentation occurs when a network is isolated from all outside com-
munications, so transactions can only occur between devices within the segmented net-
work. You can impose logical network segmentation with switches using virtual local area 
networks (VLANs), or through other traffic-control means, including MAC addresses, IP 
addresses, physical ports, TCP or UDP ports, protocols, or application filtering, routing, 
and access control management. Network segmentation can be used to isolate static envi-
ronments in order to prevent changes and/or exploits from reaching them.
Security Layers
Security layers
exist where devices with different levels of classification or sensitivity are 
grouped together and isolated from other groups with different levels. This isolation can be 
absolute or one-directional. For example, a lower level may not be able to initiate commu-
nication with a higher level, but a higher level may initiate with a lower level. Isolation can 
also be logical or physical. Logical isolation requires the use of classification labels on data 
and packets, which must be respected and enforced by network management, OSs, and 
applications. Physical isolation requires implementing network segmentation or air gaps 
between networks of different security levels.