Open Enterprise Security Architecture O Esa Pdf

Return to site

Open Enterprise Security Architecture O Esa Pdf

Open Security Architecture
Enterprise Security Reference Architecture
Open Enterprise Security Architecture (o-esa) Pdf
Open Enterprise Security Architecture O Esa Pdf Download
Open Enterprise Security Architecture O Esa Pdf File
Open Enterprise Security Architecture O Esa Pdf Fillable
Enterprise Security Architecture
Designing your optimal security architecture – Our Services help you to avoid information security risks and ensure you achieve sustainable business growth
Publisher and Knowledge Partner of Best Practices books and ebooks in It Management, Project Management Enterprise Architecture and Business Management. Framework for Enterprise Security Architecture The Open Group EA Practitioners Conference - Johannesburg 2013 33 Requirements (corporate and customer) Framework for ESA Enablement (ISMS) security management process and reference model (mainly ISO 27001) Enforcement (Practices) controls / techniques (mainly ISO 27002) specific standards.
When organisations plan and build network architecture and business systems architectures, too often security architecture design is an 'after-thought'. Organisations neglect to include in their physical and logical topologies the security policies, technology standards, guidelines, and security architecture. Where business critical business systems are planned, security architecture designs and configuration do not systematically adhere to the same Systems Development Lifecycle (SDLC) that is followed by business systems. The risk to your business operations is raised where your security architecture is not part of the business systems plan, design, build and run. For example, implementing an ERP solution where the technical impact of the reverse proxy is not considered. Instead, in this example, the same SDLC methodology rigour that is applied to the ERP should be applied to the reverse proxy, as part of the critical path in the Project Plan.
We assist with your Security Architecture designs and optimization based on the Open-Enterprise Security Architecture (O-ESA), NIST 800-53, SANS Top 20 Critical Security Controls, COBIT, and ISO27001/2. We assist with the high level and low level designs across the Security in Depth (Security Technology Architecture) covering: Conceptual Architecture, Logical Architecture, and Physical Architecture.
Conceptual architecture is the conceptual structure for policy enforcement through security services. Logical architecture is the logical components for the security services. Physical architecture is specific security products and how they are connected and what functionality, performance and reliability they provide. We assist with the high level and low level designs across security in depth layers.
The GRCBizassurance solution delivery team has implemented several of these security tools in various clients.
We will apply our proven security lifecycle methodology to implement selected security solutions in your organisation based on your 'defence in depth' requirements as depicted below.
Your organization will be able to:
Adopt a scalable enterprise security solution architecture & roadmap, and architecture repositories based on a fit for purpose information security
Ensure compliance to Enterprise Open Security Architecture leading practices – and your security Policies
Ensure that solutions that 'go live' are not a risk for your business – i.e. compliant to your security policies and security frameworks found in SANS, NIST, CIS, COBIT, King III, ISO27001/2
Optimize technical and business value from your security architecture portfolio investment
Enterprise information security architecture (EISA) is a part of enterprise architecture focusing on information security throughout the enterprise. The name implies a difference that may not exist between small/medium-sized businesses and larger organizations.
Overview[edit]Enterprise information security architecture (EISA) is the practice of applying a comprehensive and rigorous method for describing a current and/or future structure and behavior for an organization's security processes, information security systems, personnel, and organizational sub-units so that they align with the organization's core goals and strategic direction. Although often associated strictly with information security technology, it relates more broadly to the security practice of business optimization in that it addresses business security architecture, performance management, and security process architecture as well.
Enterprise information security architecture is becoming a common practice within the financial institutions around the globe. The primary purpose of creating an enterprise information security architecture is to ensure that business strategy and IT security are aligned. As such, enterprise information security architecture allows traceability from the business strategy down to the underlying technology.
Enterprise information security architecture topics[edit]Open Security ArchitecturePositioning[edit]Enterprise Security Reference ArchitectureEnterprise information security architecture was first formally positioned by Gartner in their whitepaper called 'Incorporating Security into the Enterprise Architecture Process'.[1] This was published on 24 January 2006. Since this publication, security architecture has moved from being a silo based architecture to an enterprise focused solution that incorporates business, information and technology. The picture below represents a one-dimensional view of enterprise architecture as a service-oriented architecture. It also reflects the new addition to the enterprise architecture family called 'Security'. Business architecture, information architecture and technology architecture used to be called BIT for short. Now with security as part of the architecture family it has become BITS.
Security architectural change imperatives now include things like
Business roadmaps
Legislative and legalrequirements
Industry trends
Risk trends
Visionaries
Goals[edit]Provide structure, coherence and cohesiveness.
Must enable business-to-security alignment.
Defined top-down beginning with business strategy.
Ensure that all models and implementations can be traced back to the business strategy, specific business requirements and key principles.
Provide abstraction so that complicating factors, such as geography and technology religion, can be removed and reinstated at different levels of detail only when required.
Establish a common 'language' for information security within the organization

Methodology[edit]The practice of enterprise information security architecture involves developing an architecture security framework to describe a series of 'current', 'intermediate' and 'target' reference architectures and applying them to align programs of change. These frameworks detail the organizations, roles, entities and relationships that exist or should exist to perform a set of business processes. This framework will provide a rigorous taxonomy and ontology that clearly identifies what processes a business performs and detailed information about how those processes are executed and secured. The end product is a set of artifacts that describe in varying degrees of detail exactly what and how a business operates and what security controls are required. These artifacts are often graphical.
Given these descriptions, whose levels of detail will vary according to affordability and other practical considerations, decision makers are provided the means to make informed decisions about where to invest resources, where to realign organizational goals and processes, and what policies and procedures will support core missions or business functions.
A strong enterprise information security architecture process helps to answer basic questions like:
What is the information security risk posture of the organization?
Is the current architecture supporting and adding value to the security of the organization?
How might a security architecture be modified so that it adds more value to the organization?
Based on what we know about what the organization wants to accomplish in the future, will the current security architecture support or hinder that?
Implementing enterprise information security architecture generally starts with documenting the organization's strategy and other necessary details such as where and how it operates. Kiss x sis full episode download. The process then cascades down to documenting discrete core competencies, business processes, and how the organization interacts with itself and with external parties such as customers, suppliers, and government entities.
Having documented the organization's strategy and structure, the architecture process then flows down into the discrete information technology components such as:
Organization charts, activities, and process flows of how the IT Organization operates
Organization cycles, periods and timing
Suppliers of technology hardware, software, and services
Applications and software inventories and diagrams
Interfaces between applications - that is: events, messages and data flows
Intranet, Extranet, Internet, eCommerce, EDI links with parties within and outside of the organization
Data classifications, Databases and supporting data models
Hardware, platforms, hosting: servers, network components and security devices and where they are kept
Local and wide area networks, Internet connectivity diagrams
Open Enterprise Security Architecture (o-esa) Pdf

Wherever possible, all of the above should be related explicitly to the organization's strategy, goals, and operations. The enterprise information security architecture will document the current state of the technical security components listed above, as well as an ideal-world desired future state (Reference Architecture) and finally a 'Target' future state which is the result of engineering tradeoffs and compromises vs. the ideal. Essentially the result is a nested and interrelated set of models, usually managed and maintained with specialised software available on the market.
Such exhaustive mapping of IT dependencies has notable overlaps with both metadata in the general IT sense, and with the ITIL concept of the configuration management database. Maintaining the accuracy of such data can be a significant challenge.
Along with the models and diagrams goes a set of best practices aimed at securing adaptability, scalability, manageability etc. These systems engineering best practices are not unique to enterprise information security architecture but are essential to its success nonetheless. They involve such things as componentization, asynchronous communication between major components, standardization of key identifiers and so on.
Successful application of enterprise information security architecture requires appropriate positioning in the organization. The analogy of city-planning is often invoked in this connection, and is instructive.
An intermediate outcome of an architecture process is a comprehensive inventory of business security strategy, business security processes, organizational charts, technical security inventories, system and interface diagrams, and network topologies, and the explicit relationships between them. The inventories and diagrams are merely tools that support decision making. But this is not sufficient. It must be a living process.
The organization must design and implement a process that ensures continual movement from the current state to the future state. The future state will generally be a combination of one or more
Closing gaps that are present between the current organization strategy and the ability of the IT security dimensions to support it
Closing gaps that are present between the desired future organization strategy and the ability of the security dimensions to support it
Necessary upgrades and replacements that must be made to the IT security architecture based on supplier viability, age and performance of hardware and software, capacity issues, known or anticipated regulatory requirements, and other issues not driven explicitly by the organization's functional management.
On a regular basis, the current state and future state are redefined to account for evolution of the architecture, changes in organizational strategy, and purely external factors such as changes in technology and customer/vendor/government requirements, and changes to both internal and external threat landscapes over time.
Open Enterprise Security Architecture O Esa Pdf DownloadHigh-level security architecture framework[edit]Huxham Security Framework
Enterprise information security architecture frameworks is only a subset of enterprise architecture frameworks. If we had to simplify the conceptualabstraction of enterprise information security architecture within a generic framework, the picture on the right would be acceptable as a high-level conceptual security architecture framework.
Other open enterprise architecture frameworks are:
Extended Enterprise Architecture Framework (E2AF) from the Institute For Enterprise Architecture Developments.
Federal Enterprise Architecture of the United States Government (FEA)
Capgemini's Integrated Architecture Framework[2]
NIH Enterprise Architecture Framework[3]
Open Security Architecture[4]
Information Assurance Enterprise Architectural Framework (IAEAF)
Service-Oriented Modeling Framework (SOMF)

Methodology[edit]The practice of enterprise information security architecture involves developing an architecture security framework to describe a series of 'current', 'intermediate' and 'target' reference architectures and applying them to align programs of change. These frameworks detail the organizations, roles, entities and relationships that exist or should exist to perform a set of business processes. This framework will provide a rigorous taxonomy and ontology that clearly identifies what processes a business performs and detailed information about how those processes are executed and secured. The end product is a set of artifacts that describe in varying degrees of detail exactly what and how a business operates and what security controls are required. These artifacts are often graphical.
Given these descriptions, whose levels of detail will vary according to affordability and other practical considerations, decision makers are provided the means to make informed decisions about where to invest resources, where to realign organizational goals and processes, and what policies and procedures will support core missions or business functions.
A strong enterprise information security architecture process helps to answer basic questions like:
What is the information security risk posture of the organization?
Is the current architecture supporting and adding value to the security of the organization?
How might a security architecture be modified so that it adds more value to the organization?
Based on what we know about what the organization wants to accomplish in the future, will the current security architecture support or hinder that?
Implementing enterprise information security architecture generally starts with documenting the organization's strategy and other necessary details such as where and how it operates. Kiss x sis full episode download. The process then cascades down to documenting discrete core competencies, business processes, and how the organization interacts with itself and with external parties such as customers, suppliers, and government entities.
Having documented the organization's strategy and structure, the architecture process then flows down into the discrete information technology components such as:
Organization charts, activities, and process flows of how the IT Organization operates
Organization cycles, periods and timing
Suppliers of technology hardware, software, and services
Applications and software inventories and diagrams
Interfaces between applications - that is: events, messages and data flows
Intranet, Extranet, Internet, eCommerce, EDI links with parties within and outside of the organization
Data classifications, Databases and supporting data models
Hardware, platforms, hosting: servers, network components and security devices and where they are kept
Local and wide area networks, Internet connectivity diagrams
Open Enterprise Security Architecture (o-esa) PdfWherever possible, all of the above should be related explicitly to the organization's strategy, goals, and operations. The enterprise information security architecture will document the current state of the technical security components listed above, as well as an ideal-world desired future state (Reference Architecture) and finally a 'Target' future state which is the result of engineering tradeoffs and compromises vs. the ideal. Essentially the result is a nested and interrelated set of models, usually managed and maintained with specialised software available on the market.
Such exhaustive mapping of IT dependencies has notable overlaps with both metadata in the general IT sense, and with the ITIL concept of the configuration management database. Maintaining the accuracy of such data can be a significant challenge.
Along with the models and diagrams goes a set of best practices aimed at securing adaptability, scalability, manageability etc. These systems engineering best practices are not unique to enterprise information security architecture but are essential to its success nonetheless. They involve such things as componentization, asynchronous communication between major components, standardization of key identifiers and so on.
Successful application of enterprise information security architecture requires appropriate positioning in the organization. The analogy of city-planning is often invoked in this connection, and is instructive.
An intermediate outcome of an architecture process is a comprehensive inventory of business security strategy, business security processes, organizational charts, technical security inventories, system and interface diagrams, and network topologies, and the explicit relationships between them. The inventories and diagrams are merely tools that support decision making. But this is not sufficient. It must be a living process.
The organization must design and implement a process that ensures continual movement from the current state to the future state. The future state will generally be a combination of one or more
Closing gaps that are present between the current organization strategy and the ability of the IT security dimensions to support it
Closing gaps that are present between the desired future organization strategy and the ability of the security dimensions to support it
Necessary upgrades and replacements that must be made to the IT security architecture based on supplier viability, age and performance of hardware and software, capacity issues, known or anticipated regulatory requirements, and other issues not driven explicitly by the organization's functional management.
On a regular basis, the current state and future state are redefined to account for evolution of the architecture, changes in organizational strategy, and purely external factors such as changes in technology and customer/vendor/government requirements, and changes to both internal and external threat landscapes over time.
Open Enterprise Security Architecture O Esa Pdf DownloadHigh-level security architecture framework[edit]Huxham Security Framework
Enterprise information security architecture frameworks is only a subset of enterprise architecture frameworks. If we had to simplify the conceptualabstraction of enterprise information security architecture within a generic framework, the picture on the right would be acceptable as a high-level conceptual security architecture framework.
Other open enterprise architecture frameworks are:
Extended Enterprise Architecture Framework (E2AF) from the Institute For Enterprise Architecture Developments.
Federal Enterprise Architecture of the United States Government (FEA)
Capgemini's Integrated Architecture Framework[2]
NIH Enterprise Architecture Framework[3]
Open Security Architecture[4]
Information Assurance Enterprise Architectural Framework (IAEAF)
Service-Oriented Modeling Framework (SOMF)
Relationship to other IT disciplines[edit]Open Enterprise Security Architecture O Esa Pdf FileEnterprise information security architecture is a key component of the information security technology governance process at any organization of significant size. More and more companies[citation needed] are implementing a formal enterprise security architecture process to support the governance and management of IT.
However, as noted in the opening paragraph of this article it ideally relates more broadly to the practice of business optimization in that it addresses business security architecture, performance management and process security architecture as well. Enterprise Information Security Architecture is also related to IT security portfolio management and metadata in the enterprise IT sense.
See also[edit]References[edit]^'Incorporating Security Into the Enterprise Architecture Process'. www.gartner.com. Retrieved 30 August 2015.
^Capgemini's Integrated Architecture FrameworkArchived June 23, 2006, at the Wayback Machine
^'Enterprise Architecture'. enterprisearchitecture.nih.gov. Archived from the original on 19 June 2013. Retrieved 30 August 2015.
^'Open Security Architecture'. www.opensecurityarchitecture.org. Retrieved 30 August 2015.
Open Enterprise Security Architecture O Esa Pdf FillableFurther reading[edit]Enterprise Security ArchitectureCarbone, J. A. (2004). IT architecture toolkit. Enterprise computing series. Upper Saddle River, NJ, Prentice Hall PTR.
Cook, M. A. (1996). Building enterprise information architectures : reengineering information systems. Hewlett-Packard professional books. Upper Saddle River, NJ, Prentice Hall.
Fowler, M. (2003). Patterns of enterprise application architecture. The Addison-Wesley signature series. Boston, Addison-Wesley.
SABSA integration with TOGAF.
Groot, R., M. Smits and H. Kuipers (2005). 'A Method to Redesign the IS Portfolios in Large Organisations', Proceedings of the 38th Annual Hawaii International Conference on System Sciences (HICSS'05). Track 8, p. 223a. IEEE.
Steven Spewak and S. C. Hill (1993). Enterprise architecture planning : developing a blueprint for data, applications, and technology. Boston, QED Pub. Group.
Woody, Aaron (2013). Enterprise Security: A