1 / 19

Introduction to Security Architecture

Introduction to Security Architecture. Andy Wood Enterprise Security Architect andy@securingtheenterprise.com. Types of Security Architecture What is Security Architecture? Why do Security Architecture? What is SABSA? What is the SABSA Framework? SABSA Models SABSA in the Real World

maia-benjamin
Download Presentation

Introduction to Security Architecture

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Introduction to Security Architecture Andy Wood Enterprise Security Architect andy@securingtheenterprise.com

  2. Types of Security Architecture • What is Security Architecture? • Why do Security Architecture? • What is SABSA? • What is the SABSA Framework? • SABSA Models • SABSA in the Real World • Integration to other Frameworks • Training & Certification agenda

  3. Two types of Security Architecture: • Enterprise Security Architecture (ESA) • Part of EA function. • Development of security Models and Frameworks for business to operate under. • Drives security holistically through every part of the business. • Ensures security supports business strategy and objectives. • Solution Security Architecture (SSA) • Project / Programme Scope • Capture security requirements for project/programme • Ensure integration with enterprise models Types of security architecture

  4. Problem solutioning with a focus on Security • Ensuring security requirements are identified and met. • Ensuring controls & enablers are proportionate to risk & opportunity. • Ensuring security services are managed through its lifecycle. Security Architecture is a business supporting function • Must be maintained. • Must evolve to changes in threat landscape and business strategy. What is security architecture?

  5. To support the business deliver its objectives in a risk and opportunity managed way • Need to understand the risks and opportunities • Need to implement controls and enablers to support (1) • Need to deliver service management to support (2) Prevent introduction of unknown risk. Why do security architecture?

  6. “Methodology for developing business-driven, risk and opportunity focused security architecture, and for delivering security solutions that traceably support the business requirements.” (SABSA) Sherwood Applied Business Security Architecture (SABSA) • John Sherwood, David Lynas and Andrew Clark • Started in mid-1995 following consultancy engagements • No framework at the time (or since) to deliver ESA properly • De facto framework used today globally in different markets and sectors including government and defence. • Builds upon “missing components” from other frameworks • Doesn’t re-invent – i.e. implementation isn’t in SABSA – use PRINCE2 • Open Source & protected by SABSA Institute What is SABSA?

  7. SABSA Institute • Formed 2012/13 to protect the framework • Will ensure framework evolves and matures • Will provide resource to develop and market next versions • Manages the chartered architect exam What is SABSA?

  8. Sabsa framework

  9. SABSA Model for security architecture

  10. Sabsa matrix

  11. Many models available for direct use, or can be customised. These include: • Attribute profiling • Risk & Opportunity Model • Multi-Tiered Control Strategy • Assurance Framework • Maturity Model • Governance Model • Vitality Model • Domain & Trust Model • Policy Model • Lifecycle Model, etc… Frameworks and models

  12. Most powerful tool in SABSA • To be introduced in future TOGAF version • Conceptual abstraction of real business requirement. • Standardised and re-usable. • Provides 2-way traceability. • Defines monitoring & reporting. • Starting Taxonomy available Attribute profiling

  13. Standard attribute taxonomy

  14. Defence in depth applies layering of controls to reduce risk • are the layers providing the right type of controls? • is it cost effective? • does it meet BRs? • Multi-Tiered Control Strategy • controls architected to function • Deter, Prevent, Contain, Detect, Track, Recover and Assure • Provides cost effectiveness by preventing over investment • Traceability of controls back to BRs • Provides justification • Provides assurance around controls Multi-tiered control strategy (MTCS)

  15. MTCS Model

  16. Mtcsenhanced

  17. Green Field Architecture • Clean and simple • Brown Field Architecture • Muddy waters • Unknown current state • Heavy emphasis on strategy Sabsa in the real world

  18. Flexible and adaptive framework • Aligns with others such as • TOGAF • ITIL • COBIT • ISO27001 • SOX • PCI-DSS • And any other… Integration with frameworks

  19. Three levels • Foundation (SCF) [4,500] (knowledge of) • Official foundation course + 2 multiple choice exams (96Q’s / 75%+) in 2 hours. • Practitioner (SCP) [400] (able to apply) • One official specialised course + 2 essay questions. • Master (SCM) [8] (able to redevelop) • Two official specialist courses + 10,000 word thesis. • Four specialisms • Security Architecture Design & Development • Risk Management & Governance • Business Continuity & Crisis Management • Security Operations & Service Management Training & certification

More Related