ISC2 CISSP Practice Question

The correct answer is Keeping designs as simple and small as possible. Economy of mechanism focuses on keeping security designs as simple and small as possible. Simpler designs are easier to analyze, test, and verify for security vulnerabilities. Complex systems increase the likelihood of security flaws due to interactions between components and difficulty in comprehensive testing. This principle recognizes that complexity is the enemy of security.

Using multiple frameworks for similar functions is incorrect because using multiple frameworks for similar functions increases complexity and goes directly against the principle of economy of mechanism. This approach creates redundancy and potential inconsistencies that can lead to security vulnerabilities.

Adding extra security features beyond requirements is incorrect because adding extra security features beyond requirements increases complexity without clear justification. Each additional feature increases the attack surface and potential for vulnerabilities without necessarily improving security posture.

Implementing redundant security controls is incorrect because while defense in depth is important, implementing redundant controls must be balanced with simplicity. Truly redundant controls (as opposed to layered, complementary controls) can increase complexity and maintenance burden without proportional security benefits.