Introduction to Security Architecture Andy Wood Enterprise Security Architect andy@securingtheenterprise.com

agenda Types of Security Architecture What is Security Architecture? Why do Security Architecture? What is SABSA? What is the SABSA Framework? SABSA Models SABSA in the Real World Integration to other Frameworks Training & Certification agenda

Types of security architecture Two types of Security Architecture: Enterprise Security Architecture (ESA) Part of EA function. Development of security Models and Frameworks for business to operate under. Drives security holistically through every part of the business. Ensures security supports business strategy and objectives. Solution Security Architecture (SSA) Project / Programme Scope Capture security requirements for project/programme Ensure integration with enterprise models Types of security architecture

What is security architecture? Problem solutioning with a focus on Security Ensuring security requirements are identified and met. Ensuring controls & enablers are proportionate to risk & opportunity. Ensuring security services are managed through its lifecycle. Security Architecture is a business supporting function Must be maintained. Must evolve to changes in threat landscape and business strategy. What is security architecture?

Why do security architecture? To support the business deliver its objectives in a risk and opportunity managed way Need to understand the risks and opportunities Need to implement controls and enablers to support (1) Need to deliver service management to support (2) Prevent introduction of unknown risk. Why do security architecture?

What is SABSA? Sherwood Applied Business Security Architecture (SABSA) “Methodology for developing business-driven, risk and opportunity focused security architecture, and for delivering security solutions that traceably support the business requirements.” (SABSA) Sherwood Applied Business Security Architecture (SABSA) John Sherwood, David Lynas and Andrew Clark Started in mid-1995 following consultancy engagements No framework at the time (or since) to deliver ESA properly De facto framework used today globally in different markets and sectors including government and defence. Builds upon “missing components” from other frameworks Doesn’t re-invent – i.e. implementation isn’t in SABSA – use PRINCE2 Open Source & protected by SABSA Institute What is SABSA?

What is SABSA? SABSA Institute Formed 2012/13 to protect the framework Will ensure framework evolves and matures Will provide resource to develop and market next versions Manages the chartered architect exam What is SABSA?

Sabsa framework

SABSA Model for security architecture

Sabsa matrix

Many models available for direct use, or can be customised. These include: Attribute profiling Risk & Opportunity Model Multi-Tiered Control Strategy Assurance Framework Maturity Model Governance Model Vitality Model Domain & Trust Model Policy Model Lifecycle Model, etc… Frameworks and models

Attribute profiling Most powerful tool in SABSA To be introduced in future TOGAF version Conceptual abstraction of real business requirement. Standardised and re-usable. Provides 2-way traceability. Defines monitoring & reporting. Starting Taxonomy available Attribute profiling

Standard attribute taxonomy

Multi-tiered control strategy (MTCS) Defence in depth applies layering of controls to reduce risk are the layers providing the right type of controls? is it cost effective? does it meet BRs? Multi-Tiered Control Strategy controls architected to function Deter, Prevent, Contain, Detect, Track, Recover and Assure Provides cost effectiveness by preventing over investment Traceability of controls back to BRs Provides justification Provides assurance around controls Multi-tiered control strategy (MTCS)

MTCS Model

Mtcs enhanced

Sabsa in the real world Green Field Architecture Clean and simple Brown Field Architecture Muddy waters Unknown current state Heavy emphasis on strategy Sabsa in the real world

Integration with frameworks Flexible and adaptive framework Aligns with others such as TOGAF ITIL COBIT ISO27001 SOX PCI-DSS And any other… Integration with frameworks

Training & certification Three levels Foundation (SCF) [4,500] (knowledge of) Official foundation course + 2 multiple choice exams (96Q’s / 75%+) in 2 hours. Practitioner (SCP) [400] (able to apply) One official specialised course + 2 essay questions. Master (SCM) [8] (able to redevelop) Two official specialist courses + 10,000 word thesis. Four specialisms Security Architecture Design & Development Risk Management & Governance Business Continuity & Crisis Management Security Operations & Service Management Training & certification