Finland
Germany
Denmark
Sweden
Italy
Netherlands
Norway 
Interpretation of Enterprise Security Architecture
A robust approach to information security is top-down and business aligned to provide traceability and justification for security controls, both technical and non-technical. Information security and risk management practices should be practical, appropriate, and economically proportionate to ensure effort and resources are focused accordingly.
A holistic approach to information security ensures compliance and conformance to all best practice standards and frameworks, as well as internal and external security influences. While offering adaptable, agile environments that promote and facilitate business activities, proven approaches present strong security structures to guard against the most recent and sophisticated attacks.
The following layered architecture views, as defined by SABSA, present holistic enterprise information security and should be considered in organizational security architecture engagements:
| Business View – Contextual Layer | Business assets, goals, and objectives | Service Manager’s View – Service Management: Risk assessments, audits, reviews, and Management |
| Architect’s View – Conceptual Layer | Security domains, frameworks, and strategies | |
| Designer’s View – Logical Layer | Information assets, systems, host platforms, layout, and networks | |
| Builder’s View – Physical Layer | Applications, systems, host platforms, layout, networks | |
| Tradesman’s View – Component Layer | ICT products, tools, protocols, identities, and addresses |
Technical security architectures should present controls that manage identified risks, aligned to a set of business-driven policies (for each risk domain), to enable governability. Where policies don’t exist to drive technical security architectures, they should at least follow industry best practices to ensure common, fundamental IT risks can be identified and managed.
From a logical perspective, it doesn’t really matter how the physical and component controls are applied or which vendors and technologies are used, as long as they adhere to the requirements set out by the first three security architecture layers: Contextual, Conceptual and Logical.
This approach ensures repeatability and consistency using a methodology that presents adaptive and dynamic security that supports and enables all business initiatives, including Cloud, Enterprise Mobility and BYOD.
Security on its own is meaningless. Getting this right ensures longevity and relevance to the business to securely enable opportunities and manage risk according to an appropriate risk appetite.
The engagement should focus on all security layers or any subset of these to deliver a detailed report that presents a snapshot of your current-state security profile and, where necessary, defines new security policies, procedures, and standards.
The layers shown in the SABSA Framework can be broken down into technical and non-technical areas – as in, controls versus paper-based controls.
The general tendency has been to adopt a traditional focus on information security, which has meant a focus on the bottom three layers only, namely: Physical Architecture, Component Architecture and Service Management Architecture.
With a focus on the bottom three layers alone, we can lose sight of and lose alignment with what the business is trying to achieve. This is one of the primary reasons why security project funding has decreased as a percentage of total IT spend over recent years in most organisations.
So if we expand the focus to include the upper three layers, we become far more business aligned, thus more relevant to the business, not just IT. This results in us being more adaptable when the business comes to us with new challenges and projects that need to be enabled through a risk management approach to ensure a secure initiative, e.g. Cloud or Enterprise Mobility.
A security strategy is about integrating security into the business, specifically involving upper management and changing the way business is done. Your information security program should enable your business to accomplish its business objectives.
For example, if one of your business objectives is to conduct a certain percentage of business electronically, your information security program should support this objective and increase the likelihood of success.
No Comments