Security Architecture
Introduction
I believe Information architecture is the most important as it represents the business by the information and information flow. I think it is synonymous with the company and technical requirements where everything else is built. A lousy requirement will have adverse effects downstream towards other architectures. According to (John Sherwood, 2005), Every business relationship, every business process, every business transaction, everything about the business, it's planning, its control, its management, and its success or failure are represented by information. Information is an abstract representation of something real and tangible.
With a completed and well-thought-out information architecture, all security architectures downstream will be constructed correctly and with minimal rework, if any. However, to be successful, you need a diverse understanding of industry standards for creating, storing, accessing, and presenting information (usability.gov, 2020).
With a completed and well-thought-out information architecture, all security architectures downstream will be constructed correctly and with minimal rework, if any. However, to be successful, you need a diverse understanding of industry standards for creating, storing, accessing, and presenting information (usability.gov, 2020).
The SABSA Model
SABSA (Sherwood Applied Business Security Architecture) is a business-driven, end-to-end development methodology designed to manage risk and opportunity-focused Security Architectures at both enterprise and solutions levels that traceably support business objectives (SABSA, 2020). SABSA enables a holistic view, highlight common issues, and incorporate analysis of possible risk in the design process (USD, 2020). There are six SABSA layers, and they are interconnected.
The Layers of SABSA Architecture
The contextual layer is the business view and defines the context in which the security system will operate (Balinda, 2019). Specification from the contextual layer informs the conceptual layer allowing architects to develop a concept of putting up a plan that will secure company assets. Based on the conceptual design, the logical layer lays out the components and information flow. The logical layer informs the physical layer allowing system builders to build security mechanisms to specification. The physical layer informs the component layer allowing products and tools implementation per specification. The management layer is connected to all the previous layers and provides overall control, allowing checks, balances, and operation over the whole system. Finally, the inspector's view is concerned with end-to-end system audit and ensuring the architecture is complete and fit for use (John Sherwood, 2005).
The 36-Cell of the SABSA Matrix