Security Architecture

Security architecture must address the wider range of requirements. Successful architecture is business-focused. Security Architecture artifacts are valuable tools for maintaining consistency and traceability in security design because it provides a holistic, enterprise-wide view. It provides the means to break up the complexity so as to present greater simplicity and thus make design activity easier to manage. One of the ways to simplify complexity is to create architectural reference models that use layering of functionality to break down the complex whole into a series of less-complex conceptual layers. (Sherwood, Clark, & Lynas, 2005)

Source:

Sherwood, J., Clark, A., & Lynas, D. (2005). The Meaning of Architecture. In J. Sherwood, A. Clark, & D. Lynas, Enterprise Security

Architecture (p. 28-30). San Francisco: CMP Books.

The SABSA Matrix

The six key questions that have been asked at every layer to provide a vertical analysis.

The six vertical architectural elements are summarized for all six horizontal layers. The 6 x 6 matrix of cells represent the whole model for the enterprise security architecture. It is call the SABSA® Matrix. If you can address the issues raised by each and every one of these cells, then you will have covered the entire range of questions to be answered, and you can have a high level of confidence that your security architecture is complete. The process of developing an enterprise security architecture is a process of populating all of these 36 cells.

Answering the questions:

What are you trying to do at this layer? -The assets to be protected by your security architecture;
Why are you doing it? - The motivation for wanting to apply security, expressed in the terms of this layer;
How are you trying to do it? -The functions needed to achieve security at this layer;
Who is involved? -The people and organizational aspects of security at this layer;
Where are you doing it? -The locations where you apply your security, relevant to this layer;
When are you doing it? -The time-related aspects of security relevant to this layer. (Sherwood, Clark, & Lynas, 2005)

Image Source: sabsa.org

Source:

Sherwood, J., Clark, A., & Lynas, D. (2005). Security Architecture Model. In J. Sherwood, A. Clark, & D. Lynas, Enterprise Security

Architecture (p. 41-42). San Francisco: CMP Books.