SABSA A Brief Introduction

SABSA A Brief Introduction Mark Battersby 2013-05-15

Agenda SABSA Overview SABSA Security Architecture SABSA Security Architecture Matrix Operational Security Architecture Matrix SABSA Business Attributes SABSA Strategy and Concept/Design Process SABSA Architecture Development Process SABSA Lifecycle 2011 Capgemini. All rights reserved. 2

SABSA Overview The SABSA (Sherwood Applied Business Security Architecture) framework has evolved as a "best practice" method for delivering cohesive information security solutions to enterprises SABSA is a six-layer model covering all four parts of the IT lifecycle: Strategy, Design, Implementation and Management & Operations SABSA ensures the security needs of your enterprise are met completely and that security services are designed, delivered, and supported as an integral part of your IT Management infrastructure SABSA is essentially a model and methodology for developing risk-driven enterprise information security 2011 Capgemini. All rights reserved. 3

SABSA Security Architecture Contextual Security Architecture: Business View: Business Risk Model Business Process Model Conceptual Security Architecture: Architects View: Control Objectives Security Strategies & Architecture Logical Security Architecture: Designers View: Security Policies Security Services Physical Security Architecture Builder s view: Security Rules, Practices, Procedures Security Mechanisms Component Security Architecture Tradesman s view: Security Standards Security Products & Tools Operational Security Architecture: Facility Manager s View: Operational Risk Mgmt Security Service Mgmt 2011 Capgemini. All rights reserved.

Enterprise Security Architecture Matrix Assets (What) Motivation (Why) Process (How) People (Who) Location (Where) Time (When) Contextual The Business Business Risk Model Business Process Model Business Organization and Relationships Business Geography Business Time Dependencies Conceptual Business Attributes Profile Control Objectives Security Strategies and Architectural Layering Security Entity Model and Trust Framework Security Domain Model Security-Related Lifetimes and Deadlines Logical Business Information Model Security Policies Security Services Entity Schema and Privilege Profiles Security Domain Definitions and Associations Security Processing Cycle Physical Business Data Model Security Rules, Practices and Procedurees Security Mechanisms Users, Applications and the User Interface Platform and Network Infrastructure Control Structure Execution Component Detailed Data Structures Security Standards Security Products and Tools Identities, Functions, Actions and ACLs Processes, Nodes, Addresses and Protocols Security Step Timing and Sequencing Operational Assurance of Operational Continuity Operational Risk Management Security Service Management and Support Application and User Management and Support Security of Sites, Networks and Platforms Security Operations Schedule An IA Architecture is a consistent set of principles, policies and standards that sets the direction and vision for the development and operation of the organisation s communication and information services so that they are aligned with and support the business needs of the organisation in an Assured way 2011 Capgemini. All rights reserved. 5

SABSA Lifecycle Strategy & Concept Contextual Conceptual Manage & Measure Design Logical, Physical, Component, Operational Attributes defined and measured Implement Copyright SABSA Limited. Printed with permission From: www.sabsa.com 2011 Capgemini. All rights reserved.