INTRODUCTION TO SECURITY ARCHITECTURE Andy Wood Enterprise Security Architect [email protected].

INTRODUCTION TO SECURITY ARCHITECTUREAndy Wood

Enterprise Security Architect

[email protected]

AGENDA

• Types of Security Architecture

• What is Security Architecture?

• Why do Security Architecture?

• What is SABSA?

• What is the SABSA Framework?

• SABSA Models

• SABSA in the Real World

• Integration to other Frameworks

• Training & Certification

TYPES OF SECURITY ARCHITECTURE

Two types of Security Architecture:

• Enterprise Security Architecture (ESA)

• Part of EA function.

• Development of security Models and Frameworks for business to operate under.

• Drives security holistically through every part of the business.

• Ensures security supports business strategy and objectives.

• Solution Security Architecture (SSA)

• Project / Programme Scope

• Capture security requirements for project/programme

• Ensure integration with enterprise models

WHAT IS SECURITY ARCHITECTURE?

Problem solutioning with a focus on Security

• Ensuring security requirements are identified and met.

• Ensuring controls & enablers are proportionate to risk & opportunity.

• Ensuring security services are managed through its lifecycle.

Security Architecture is a business supporting function

• Must be maintained.

• Must evolve to changes in threat landscape and business strategy.

WHY DO SECURITY ARCHITECTURE?

To support the business deliver its objectives in a risk and opportunity managed way

1. Need to understand the risks and opportunities

2. Need to implement controls and enablers to support (1)

3. Need to deliver service management to support (2)

Prevent introduction of unknown risk.

WHAT IS SABSA?

“Methodology for developing business-driven, risk and opportunity focused security architecture, and for delivering security solutions that traceably support the business requirements.” (SABSA)

Sherwood Applied Business Security Architecture (SABSA)

• John Sherwood, David Lynas and Andrew Clark

• Started in mid-1995 following consultancy engagements

• No framework at the time (or since) to deliver ESA properly

• De facto framework used today globally in different markets and sectors including government and defence.

• Builds upon “missing components” from other frameworks

• Doesn’t re-invent – i.e. implementation isn’t in SABSA – use PRINCE2

• Open Source & protected by SABSA Institute

WHAT IS SABSA?

SABSA Institute

• Formed 2012/13 to protect the framework

• Will ensure framework evolves and matures

• Will provide resource to develop and market next versions

• Manages the chartered architect exam

SABSA FRAMEWORK

SABSA MODEL FOR SECURITY ARCHITECTURE

SABSA MATRIX

FRAMEWORKS AND MODELS

Many models available for direct use, or can be customised.

These include:

• Attribute profiling

• Risk & Opportunity Model

• Multi-Tiered Control Strategy

• Assurance Framework

• Maturity Model

• Governance Model

• Vitality Model

• Domain & Trust Model

• Policy Model

• Lifecycle Model, etc…

ATTRIBUTE PROFILING

• Most powerful tool in SABSA

• To be introduced in future TOGAF version

• Conceptual abstraction of real business requirement.

• Standardised and re-usable.

• Provides 2-way traceability.

• Defines monitoring & reporting.

• Starting Taxonomy available

STANDARD ATTRIBUTE TAXONOMY

MULTI-TIERED CONTROL STRATEGY (MTCS)

• Defence in depth applies layering of controls to reduce risk

• are the layers providing the right type of controls?

• is it cost effective?

• does it meet BRs?

• Multi-Tiered Control Strategy

• controls architected to function

• Deter, Prevent, Contain, Detect, Track, Recover and Assure

• Provides cost effectiveness by preventing over investment

• Traceability of controls back to BRs

• Provides justification

• Provides assurance around controls

MTCS MODEL

MTCSENHANCED

SABSA IN THE REAL WORLD

• Green Field Architecture

• Clean and simple

• Brown Field Architecture

• Muddy waters

• Unknown current state

• Heavy emphasis on strategy

INTEGRATION WITH FRAMEWORKS

• Flexible and adaptive framework

• Aligns with others such as

• TOGAF

• ITIL

• COBIT

• ISO27001

• SOX

• PCI-DSS

• And any other…

TRAINING & CERTIFICATION

• Three levels

• Foundation (SCF) [4,500] (knowledge of)

• Official foundation course + 2 multiple choice exams (96Q’s / 75%+) in 2 hours.

• Practitioner (SCP) [400] (able to apply)

• One official specialised course + 2 essay questions.

• Master (SCM) [8] (able to redevelop)

• Two official specialist courses + 10,000 word thesis.

• Four specialisms

• Security Architecture Design & Development

• Risk Management & Governance

• Business Continuity & Crisis Management

• Security Operations & Service Management