the role of architecture in the enterprise
TRANSCRIPT
THE ROLE OF ARCHITECTURE
BRIDGING THE GAP BETWEEN THE ENTERPRISE AND TECHNOLOGY
THE GREAT DIVIDE
WHAT IS ENTERPRISE SECURITY ARCHITECTURE?• ENTERPRISE MEANS CONSIDERING AN
ORGANISATION AS A SINGLE ENTITY RATHER THAN A SET OF CO-OPERATING OR COMPETING SILOS
• SECURITY IS DIFFERENT FOR EVERY ORGANISATION
• ARCHITECTURE – IS BOTH A PROCESS AND A PRODUCT• PROCESS = PLANNING, DESIGN AND
CONSTRUCTION• PRODUCT = PEOPLE, PROCESS AND
TECHNOLOGY
THE EVOLUTION OF SECURITY
• LATE 1980’S – ISO7498:2
• LATE 1990’S – 2000’S - SECURITY TECHNOLOGIES USED AS A COUNTERMEASURE TO COMBAT VIRUSES AND UNAUTHORISED ACCESS
• LEFT ALONE TO TECHNOLOGISTS, SECURITY WAS SEEN AS THE BUSINESS PREVENTION DEPARTMENT
THE RESULT
• DISCONNECT BETWEEN THE BUSINESS NEEDS AND TECHNOLOGY, INFORMATION ASSURANCE
• SECURITY SEEN AS AN ADD-ON – ROI HARD TO GAUGE
• SECURITY ROLLED IN TACTICALLY AS PART OF PROJECT DELIVERY
TACTICAL SOLUTIONS COST MORE!USED TO SOLVE AN IMMEDIATE PROBLEM, BUT:• UNDERTAKEN AS A SILOED APPROACH• DEPLOYED SOLUTIONS LACK FLEXIBILITY• UNFORESEEN INTEGRATION COMPLEXITIES• ISSUES WITH INTEROPERABILITY• HIGHER SUPPORT COSTS (DIVERSE SYSTEMS)• DIFFERENT PERSPECTIVES AND APPROACHES• ADDITIONAL RESOURCES OFTEN REQUIRED
THE REAL ROLE OF SECURITY
PROVIDE CONFIDENCE AND ASSURANCE:• DEPENDABILITY (RELIABLE)• SUITABILITY (FIT FOR PURPOSE)• TRUST IN PEOPLE, PROCESS & TECHNOLOGY• NOT EXPOSED TO UNACCEPTABLE LEVELS OF RISK
SECURITY MUST ENABLE THE BUSINESS TO MEET ITS OBJECTIVES, IDENTIFY AND TRANSFORM OPPORTUNITIES.
THE IMPORTANCE OF A FRAMEWORK• ALLOWS ORGANISATIONS TO MANAGE COMPLEXITY• MAINTAIN INTEGRITY OF DESIGN AT ALL STAGES• PROVIDES A ROADMAP FOR ALL• LOWERS THE TOTAL COST OF OWNERSHIP• INTEGRATION AND INTEROPERABILITY• RESOLVE CONFLICTING OBJECTIVES AND PRIORITIES• PREDICTABLE OUTCOMES• FLEXIBLE AND AGILE SOLUTIONS• BALANCE BETWEEN STRATEGIC, TACTICAL & OPERATIONAL
ARCHITECTURE GUIDING PRINCIPLESAN ARCHITECTURE MUST NOT PRESUPPOSE ANY:• CULTURES OR OPERATIONAL PRACTICES, MANAGEMENT STYLE,
MANAGEMENT PROCESSES, MANAGEMENT STANDARDS, TECHNICAL STANDARDS OR TECHNOLOGY PLATFORMS
A GOOD ARCHITECTURE:• MEETS AN ORGANISATIONS UNIQUE SET OF BUSINESS REQUIREMENTS• DOES NOT REPLACE OR COMPETE WITH ESTABLISHED POLICY,
STANDARDS, PRACTICES OR LEGISLATION BUT RATHER ENABLES THEIR DEPLOYMENT
• IS SUFFICIENTLY FLEXIBLE AND ADAPTABLE
ARCHITECTURE FRAMEWORK
A CONSISTENT SET OF PRINCIPLES, POLICIES AND STANDARDS THAT SETS THE DIRECTION AND VISION FOR THE DEVELOPMENT AND OPERATION OF THE ORGANISATION’S BUSINESS INFORMATION SYSTEMS SO AS TO ENSURE ALIGNMENT WITH AND SUPPORT FOR THE BUSINESS NEEDS.
© SABSA INSTITUTE 2016
SABSA ARCHITECTURE VIEWSBUSINESS VIEW CONTEXTUAL ARCHITECTURE
ARCHITECT’S VIEW CONCEPTUAL ARCHITECTURE
DESIGNER’S VIEW LOGICAL ARCHITECTURE
BUILDER’S VIEW PHYSICAL ARCHITECTURE
TRADESMAN’S VIEW COMPONENT ARCHITECTURE
SERVICE MANAGER’S VIEW OPERATIONAL ARCHITECTURE
VERTICAL ANALYSIS OF THE SABSA COLUMNSWHAT
WHAT ARE WE TRYING TO DO AT THIS LAYER?THE ASSETS, GOALS AND OBJECTIVES TO BE PROTECTED AND ENHANCED.
WHY WHY ARE WE DOING IT?THIS RISK AND OPPORTUNITY MOTIVATION AT THIS LAYER.
HOW HOW ARE WE TRYING TO DO IT?THE PROCESSES REQUIRED TO ACHIEVE SECURITY AT THIS LAYER.
WHOWHO IS INVOLVED?THE PEOPLE AND ORGANISATIONAL ASPECTS OF SECURITY AT THIS LAYER.
WHERE WHERE ARE WE DOING IT?THE LOCATIONS WHERE WE ARE APPLYING SECURITY AT THIS LAYER.
WHEN WHEN ARE WE DOING IT?THE TIME RELATED ASPECTS OF SECURITY AT THIS LAYER.
TWO-WAY TRACEABILITY
SABSA PROVIDES TWO-WAY TRACEABILITY FOR:• COMPLETENESS - EVERY BUSINESS REQUIREMENT FOR SECURITY IS
MET AND THE RESIDUAL RISK IS ACCEPTABLE TO THE BUSINESS• JUSTIFICATION - EVERY OPERATIONAL OR TECHNOLOGICAL SECURITY
ELEMENT CAN BE JUSTIFIED BY REFERENCE TO A RISK-PRIORITISED BUSINESS REQUIREMENT
BUSINESS DRIVEN ARCHITECTURE
• BEING BUSINESS-DRIVEN MEANS NEVER LOSING SITE OF THE ORGANISATION’S GOALS, OBJECTIVES, SUCCESS FACTORS AND TARGETS
• THE CONTEXTUAL ARCHITECTURE CAPTURES AND PRESENTS THE FULL SET OF RELEVANT REQUIREMENTS FOR THE SCOPE OF THE ASSIGNMENT
SUMMARYSABSA• IS BUSINESS DRIVEN• PROVIDES UNIQUE ATTRIBUTE PROFILING• MANAGES RISKS TO ATTRIBUTES• DOES NOT COMPETE WITH OTHER FRAMEWORKS• AN OPEN STANDARD• FREE TO USE• CAN BE ADAPTED TO SUIT ANY ORGANISATION
QUESTIONS?