2 cissp ® Official Study Guide Eighth Edition

Hardware Segmentation
Hardware segmentation
is similar to process isolation in purpose—it prevents the access 
of information that belongs to a different process/security level. The main difference is that 

---

Essential Security Protection Mechanisms 
383
hardware segmentation enforces these requirements through the use of physical hardware 
controls rather than the logical process isolation controls imposed by an operating system. 
Such implementations are rare, and they are generally restricted to national security imple-
mentations where the extra cost and complexity is offset by the sensitivity of the informa-
tion involved and the risks inherent in unauthorized access or disclosure.
Security Policy and Computer Architecture
Just as security policy guides the day-to-day security operations, processes, and procedures 
in organizations, it has an important role to play when designing and implementing sys-
tems. This is equally true whether a system is entirely hardware based, entirely software 
based, or a combination of both. In this case, the role of a security policy is to inform and 
guide the design, development, implementation, testing, and maintenance of a particular 
system. Thus, this kind of security policy tightly targets a single implementation effort. 
(Although it may be adapted from other, similar efforts, it should reflect the target as accu-
rately and completely as possible.)
For system developers, a security policy is best encountered in the form of a document that 
defines a set of rules, practices, and procedures that describe how the system should manage, 
protect, and distribute sensitive information. Security policies that prevent information flow 
from higher security levels to lower security levels are called multilevel security policies. As a 
system is developed, the security policy should be designed, built, implemented, and tested as 
it relates to all applicable system components or elements, including any or all of the follow-
ing: physical hardware components, firmware, software, and how the organization interacts 
with and uses the system. The overall point is that security needs be considered for the entire 
life of the project. When security is applied only at the end, it typically fails.