developing the corporate security architecture

Developing the Corporate Security Architecture

www.avient.caAlex WodaJuly 22, 2009

Avient Solutions Group

7/22/2009

Avient Solutions Group is based in Markham and is a professional services firm specializing in infrastructure, architecture, applications security and project management.

WIP… “AMS” Avient Managed Solutions!

Key Points

Why do we need a Corporate security architecture?Enterprise Architecture FrameworksExamples of security architectureDesigning and Implementing a Security ArchitectureHow to assess the security architecture

Information Security Challenge

Change inInfra-structure

Changes the Nature of Risk

Change in the Nature of Work

Change inInfo-structure

Trust and Truth

Key Performance Indicators:

Revenue, Profitability, Cash flow, Value creation

Value Based Management

Privacy & Security

Business Drivers

Government Regulations and AuditsSarbanes OxleyBill C-198PIPEDA Bill C-6

Industry Security RegulationsPayment Card Industry Data Security StandardsOpen Web Application Security Project (OWASP)ISO 17799, ISO 27002

Business RelationshipsOutsourced servicesSupply chain integrationRemote access to internal systems

Technology Drivers

New Technologies and InfrastructurePurchased applicationsIntegration of systems

New information collection and storageSensitive data and encryptionData leakage

Cloud ComputingWeb based access to applicationsThird party control

Malicious code Trojans, virusesVulnerabilities in software

External attack methodsCross site scriptingBuffer overflowsMemory parsers

Information Security Stakeholders

InformationSecurity Management

Customers

Suppliers

Management Regulators

Shareholders Employees

•Network connections•Service Agreements•Continuity Planning

•Laws and Statutes•Security and Privacy•Compliance management

•Information Integrity•Confidentiality•Intellectual Propertyprotection

•Cost management

•Health and Safety•Privacy protection•Trust

•Risk Management•Trust and Safety•Investment Protection

•Privacy Protection•Trust and Safety•Safeguards

Enterprise Architecture Frameworks

TOGAF Enterprise Architecture FrameworkIntegration of security into different domainsArchitecture development method available

Zachman Enterprise Architecture Framework Set of models to represent WHAT, HOW and WHERE

Complete the design with WHO, WHEN and WHYSystematic description of business models, processes, data requirementsSet of standard artifacts to foster communication and collaborationSecurity Architecture called SABSA

Vendor Defined ArchitectureIBM Architecture Methods

Security Architecture Frameworks

TOGAF Version 9SABSA - SherwoodISO 17799 security frameworkAgile Security Strategies ISO 13335 - security practicesISO 7498-2NSA standards - Gold for Win2KCisco SAFE

TOGAF and Security

Security domain is pervasive across the other domainsAreas of focus:

AuthenticationAuthorizationAuditAssuranceAvailabilityAsset ProtectionAdministrationRisk Management

Security as part of Enterprise Architecture

Integrated with Enterprise ArchitectureBusiness architectureInformation architectureApplication architectureTechnology architectureSecurity architecture

Security participation in project teamsCreation of security analysis and design plans for each significant project

Conceptual Security Framework

1. Based on British Standard 7799: “Code of Practice for Information Security Management” and NIST

Security

Policy

Security

Organization

Physical and

Environmental

Security

Computer and

NetworkManagement

BusinessContinuityPlanning

PersonnelSecurity Asset

Classification

and Control

SystemDevelopment

andMaintenance

AccessControl

Compliance

Security

TEN KEY CONTROLS

Example of a Security Architecture ModelIBM has a model for Security Architecture. This is illustrated in the following diagram. The Security Services correspond to the logical Components within the IT Architecture. As such there is a natural linkage between the two Architectures.

Management

Objects

Mechanisms

Services

ServicesManagement

POLICY

MANAGEMENT

AUDIT

&

ALERT

MANAGEMENT

Confidentiality DataIntegrity

NonRepudiation

AccessControl

Identification&

Authentication

Management

ObjectManagement

EntityAuthentication

Access Control Lists

SecurityLabels

EncipherDecipher

MessageAuthentication

ModificationDetection

DigitalSignature

UsersGroups

PrivilegesAuditLogs

ProgramsEncryption

Keys

Passwords

SYSTEM

INTEGRITY

Based on ISO Standard 7498-2

e.g. DATA

ENTERPRISE ARCHITECTURE - A FRAMEWORK

Builder

SCOPE(CONTEXTUAL)

MODEL(CONCEPTUAL)

ENTERPRISE

Designer

SYSTEMMODEL(LOGICAL)

TECHNOLOGYMODEL(PHYSICAL)

DETAILEDREPRESEN- TATIONS(OUT-OF- CONTEXT)

Sub-Contractor

FUNCTIONINGENTERPRISE

DATA FUNCTION NETWORK

e.g. Data Definition

Ent = FieldReln = Address

e.g. Physical Data Model

Ent = Segment/Table/etc.Reln = Pointer/Key/etc.

e.g. Logical Data Model

Ent = Data EntityReln = Data Relationship

e.g. Semantic Model

Ent = Business EntityReln = Business Relationship

List of Things Importantto the Business

ENTITY = Class ofBusiness Thing

List of Processes theBusiness Performs

Function = Class ofBusiness Process

e.g. Application Architecture

I/O = User ViewsProc .= Application Function

e.g. System Design

I/O = Data Elements/SetsProc.= Computer Function

e.g. Program

I/O = Control BlockProc.= Language Stmt

e.g. FUNCTION

e.g. Business Process Model

Proc. = Business ProcessI/O = Business Resources

List of Locations in which the Business Operates

Node = Major BusinessLocation

e.g. Business Logistics System

Node = Business LocationLink = Business Linkage

e.g. Distributed System

Node = I/S Function(Processor, Storage, etc)Link = Line Characteristics

e.g. Technology Architecture

Node = Hardware/SystemSoftware

Link = Line Specifications

e.g. Network Architecture

Node = AddressesLink = Protocols

e.g. NETWORK

Architecture

Planner

Owner

Builder

ENTERPRISEMODEL

(CONCEPTUAL)

Designer

SYSTEMMODEL

(LOGICAL)

TECHNOLOGYMODEL

(PHYSICAL)

DETAILEDREPRESEN-

TATIONS (OUT-OF

CONTEXT)

Sub-Contractor

FUNCTIONING

MOTIVATIONTIMEPEOPLE

e.g. Rule Specification

End = Sub-conditionMeans = Step

e.g. Rule Design

End = ConditionMeans = Action

e.g., Business Rule Model

End = Structural AssertionMeans =Action Assertion

End = Business ObjectiveMeans = Business Strategy

List of Business Goals/Strat

Ends/Means=Major Bus. Goal/Critical Success Factor

List of Events Significant

Time = Major Business Event

e.g. Processing Structure

Cycle = Processing CycleTime = System Event

e.g. Control Structure

Cycle = Component CycleTime = Execute

e.g. Timing Definition

Cycle = Machine CycleTime = Interrupt

e.g. SCHEDULE

e.g. Master Schedule

Time = Business EventCycle = Business Cycle

List of Organizations

People = Major Organizations

e.g. Work Flow Model

People = Organization UnitWork = Work Product

e.g. Human Interface

People = RoleWork = Deliverable

e.g. Presentation Architecture

People = UserWork = Screen Formate.g. Security Architecture

People = IdentityWork = Job

e.g. ORGANIZATION

Planner

Owner

to the BusinessImportant to the Business

What How Where Who When Why

John A. Zachman, Zachman International (810) 231-0531

SCOPE(CONTEXTUAL)

Architecture

e.g. STRATEGYENTERPRISE

e.g. Business Plan

TM

Security test strategy and test plans

Integration of security components and mechanisms

Security logging, access control, security reportsBackup plans

Security interface for users and administratorsAuthentication mechanism

Network communication security mechanisms

Security components, objects and mechanisms

Database security mechanismsFile securityAudit trails and log security

Physical

Chart 4 & 5 of TRAComplete PIASelect security products

Determine level of protection required for assets, functions and data(accepted risk)

Business and system impact analysisWhen is security enforced?

Access to functions and transactionsSecurity Administration requirements

Middleware security and data transfer security requirements

Security requirements for sensitive processes (logging, access control)

Security requirements for Personal and Critical data fields(Isolation, edits, encryption)

Logical

Identification of security mechanisms and components (PKI, encryption)

Identify specific assets and functions at riskVulnerability analysis

Availability and recovery requirements Service Levels

User authentication and authorization requirementsPrivacy impact

Location and network protection requirements(firewalls, encryption)

Identify sensitive and critical Processes and resourcesRisk identification

Business Continuity ManagementIdentify data of sensitive or personal nature (Privacy, Integrity)

Conceptual

Charts 1, 2 and 3 of TRAHigh level PIA

Why are threats present? Consequences and impactCorporate Policies

Business CalendarProbability of threats occurringImportance of service (Critical?)

Stakeholders, users, external parties (Privacy, Sensitivity)

Business field operations management Interfaces to trading partners – Data collection and usage(Sensitivity)

Business driven information security management program

Identify general nature of data(personal, confidential, financial, critical)Collection Methods

Contextual

DeliverablesMotivation (why)Time (when)People (Who)Network (Where)Function (How)Data (What)Level

Zachman Based Security Architecture (SABSA)

15

Security Building Blocks

Security

Standards

Standards• Security standards make

specific mention of technologies, methodologies, implementation procedures and other details.

• It is used by the enterprise to implement the security policy.

SERVICESMECHANISMS

OBJECTS

APPLICATIONCOMMONSERVICES

NETWORK

SYSTEM Windows NTUNIX

NetworkInfrastructure

DB2

Secu

rity

Sta

ndar

d

Security

Policy

Policy• A security policy outlines an organization's

position on security issues. It must be endorsed and supported by Management.

• A good security policy can be simply stated, easily understood and in a form that can be widely communicated.

Security

Processes

Processes• Processes are created and

implemented with respect to polices and standards.

• Part of the process is an assessment of existing process to ensure business needs are still met.

ImplementationRisk Assessment

Policy

AdministrationAudit

THE SECURITY LIFECYCLE

Security Architecture Foundation Deliverables

Risk Management Templates and GuidelinesThreat risk assessment process

Privacy Management guide and formsEnterprise security architecture visionSecurity Architecture Design Document templatesTechnical security standards - BaselineProject team training programEnterprise security architecture migration plan

Security Vision

Mail, FTPInternet

Web HostingHighly Secure Zone

LDAPSecurity Service Restricted

Data

RestrictedZone SecurityCredentials

InternalUsers

FirewallVLAN

Role BasedAuthorization

Application

Internal Data

ConfidentialData

System EventLogging

ApplicationLogging

Application Application

SharedDMZ Internal

Zone

PartnerDMZ

Third PartyDMZ

PartnerDMZ

Third PartyConnections

IntegrationServices

Application

PartnerZone

ApplicationPublicData

BankingServices

Business Intelligence

OLAP

LDAPSecurity Service File

Directories

RemoteAccessDMZ

Remote AccessUsers

Risk Assessment Methods

Spans across all domains and is applied in contextFormal methods and deliverables must be usedShould be facilitated or reviewed by security expertsIndustry Standards (samples)

Operationally critical threat asset vulnerability evaluation (OCTAVE)NIST SP 800 Threat risk assessment guideNew Zealand / Australia AZ/NZS 4360 methodIRM, ALARM

Threat Risk Assessment Process

PlanningTRA

Preparation Analysis Action Plans•Scope•Boundary•Responsibility•System and dataAsset inventory•Acceptable risks•General Threats

•Identify Assets•Tangible•Intangible

•Statement of Sensitivity

•Threat AnalysisIdentify ThreatsProbability of OccurrenceConsequence

•Risk AnalysisVulnerabilitiesControlsAssessment

•Accept Risk•Improve Controls•New Controls•Manage Risk•(Avoid)•(Transfer)

Threat Risk Assessment Deliverables

Security Plan for the systemDescription of the risks and environmentComponent placement, server functions, diagramsData classification

Description of risks and key controls to be usedList of baseline security componentsIdentify new security methods or componentsSecurity testing methodsLogging and Monitoring requirements

Privacy Risks

Unauthorized disclosure of data to external partiesConstruction of data profiles

Data matching and user monitoringUnauthorized use of private dataInadequate protection and safeguardsIncorrect data used for decision purposes

Privacy Impact Assessment

Assessment of privacy risks during systems under developmentPrivacy risk assessment document to be completedIdentify and classify personal private data

Where and how is it collected?Where is it processed?Where is it stored and with what other data?Is the data disclosed to other users or systems?

Document data flow and user actionsSelect controls and establish processes

Security Architecture Benefits

Business AlignmentRisk driven selection and management of controlsParticipation during system developmentBusiness support and business enablement

Cost ManagementReusability of components and processesEfficient administration and maintenance

Ease of IntegrationScalability of solutionsTrusted solutions

Life Cycle Risk Management

Money/Risk

Time

t0t-..1/5t--1Governance

Bus. Req. Design Development OperationsImplementation

The objective is to lower the risk

Practices and technology

Design reviews

Audit

Tests and certification

Technology insertion

Information Security Operation

Information Protection Center and Information Security Operations

Security at the Systems Layer

Logical Security ArchitectureCompliance to Policies and Standards Identity managementAuthorizaton servicesMessaging securityData encryptionAudit and logging facilitiesMalicious code protectionApplication IntegrationDeliverables:

Logical Threat Risk assessmentPrivacy impact assessment

Security at the Technology Layer

Infrastructure ProtectionNetwork Perimeter security protectionNetwork SegmentationNetwork identity managementAuthorization Intrusion detectionRemote System AccessVPN and EncryptionLogging and monitoringDeliverables:

Physical Threat Risk assessmentTesting MethodsLogging and monitoring tests

Security Strategy

TechnologyNetwork protection methodsIntrusion detectionLogging and monitoringChannel level encryptionSecurity StandardsSecurity AdministrationCode protection

Security Analysis and ManagementEnterprise Architecture MethodsRisk Management MethodsPrivacy assessment methodsIdentity, authentication and authorizationMulti-layered Security architectureIncident managementGovernance, Risk and Compliance processes

Process IISecurity

Abstraction

Fragmented Integrated

Human centric

Technologycentric

Process I

Security

Diffusion

Formalization

Process IIISecurity

Security EnabledOrganizations

•Governance and Risk Management•Enterprise security models and tools•Integrated Security Management system

Isolated GroupsFragmented SecurityLack of standards

Security PoliciesOperations centricsecurity testing

Individualsartisansprofessionalsmanagers

Security Management Maturity model

Developing the Corporate Security Architecture

Define Security Principles and StandardsSecurity Policies, Principles and StandardsSecurity VisionBaseline security methods and controlsDefine Security Artefacts and templatesIntegrate with Technology and application domains

Define and document Core security tools and servicesIdentity managementLogging and MonitoringNetwork protection (firewalls and IDS)Malicious code protection

Define IT Security Governance processesParticipation in Systems development and technology procurement projectsIntegration with Project management methodsPhased approach for development of security artefacts (Risk Management Plan and securitydiagrams)Define Security testing requirementsAssess if the security methods / tools will be sustainableDefine a refresh process for the security architecture

Security Architecture Development

What architecture development methods are right for you?Can the security architecture be developed as a stand alone domain?Formal ADM (Strategic)

Formal templates and processesArchitecture Vision and DefinitionArchitecture Core Teams and Review BoardsArchitecture Foundation and reference library

Guidelines (Tactical)Just in time architectureArchitecture LITESecurity Vision and templates

Security Architecture Development Methodology

Conceptual Risk Assessment Identify Security business requirements

Description of current environment and processesHigh level Risk Assessment of business practices, data and technologyAssess applicability of government or industry regulationsRefine risk assessment and include future plansCreate conceptual risk report

Business risksTechnology risksOperational / financial risks

Decide level of project involvement

40


Logical Risk AssessmentLogical Security Model Development

Review with project team and create logical security architecture using core componentsIdentify new security components or methodsCreate logical threat risk assessment document

Risk assessment of each component in systemSecurity methods and controls to be implemented

Assess data protection methods and privacy impactReview with Enterprise Architecture


Physical Security Assessment Information Security Deployment and Testing

Review physical deployment diagramsValidate that security requirements are implemented

Review security methods and activitiesSystem logging and monitoringUser management Source Code validation

Define / Execute Security test strategy and planSecurity ScansVulnerability assessmentsPenetration testsDisaster Recovery Test

Update Enterprise Architecture documents Update governance risk and compliance processes

Assessing the Security Architecture

Control Objectives for IT (COBiT)Developed by ISACA as a governance framework

Plan and OrganizeAcquire and ImplementDeliver and SupportMonitor and Evaluate

Includes a guide for measuring maturityCapability Maturity Model

Must be tailored for the organizationApplied to security functions and services

Corporate Security Architecture Assessment

Review the scope of the security architectureReview target security architectureReview security policies and standardsReview security principles and visionAssess security organization and staffingIdentify Regulatory Compliance requirementsEvaluate the Risk Assessment methods in use for projects and systemsIdentify and map out the Architecture governance process for securityReview Risk issue management processAssess Security Design Plan templates and completed formsReview security management proceduresAssess Business Continuity Plan and maintenance

Step 1 - Preliminary Review of Security Architecture


Validate security plans to actual implementationAssessment of security methods, technologySecurity awareness and risk management trainingAssess how security is integrated with other architecture domainsAssess Security Components

Identity managementLogging and Monitoring systems Network protectionEncryption key management processesMalicious code protection

Step 2 - Evaluate Security foundation and components


Security implemented for the Technology and Application layersVulnerability Assessment methods in use Security Scan test methodsSecurity Reviews completed by third partiesSource code reviews and testingPhysical securityTechnical support accessBackup and Recovery processesNetwork security

Step 3 - Assess the Technical Security Architecture

Summary and Conclusions

New risks created by new technologies and business processesRegulatory compliance, including privacy is driving enhanced security requirementsIncrease risk of attacks from external sourcesEnterprise Architecture is growing in popularityChallenge to implement and maintainSecurity architecture is pervasive across the other domains of architecture -Business, data, technology and applicationsSecurity architecture is completed in layers

Conceptual, Logical, Technical Requires a framework of risk management methods, baseline standards and governance processComprehensive risk management plan for security, privacy and business continuity

developing the corporate security architecture

Documents