The slide discusses the three lines of defense in security architecture, which include management and internal control, security, risk, and compliance, and internal and external audit. Overall, the paper contributes to the understanding of Cloud IAM, the use of Forseti for policy analysis, and the importance of security architecture in ensuring the alignment of security processes with an enterprise's mission and strategic plans

1. Security Architecture:
3 Lines of Defense
M. Febri Ramadlan
Security Engineer Manager
tiket.com
1

2. About Me
● Mohammad Febri Ramadlan
● GIAC Certified Incident Handler (GCIH), Offensive Security Certified Professional (OSCP),
Certified Ethical Hacker (CEH)
● Open Source Contributor (OWASP Project Leader, Mozilla Keyholder)
Contact
● +62 81809809636
● mohammadfebrir@gmail.com
2

3. Agenda
1. Introduction
2. Security Architecture
3. 3 Lines of Defense
4. QnA
5. Conclusion
3

4. 4
Security Architecture

5. 5
“An embedded, integral part of the enterprise architecture that describes the
structure and behavior for an enterprise’s security processes, information
security systems, personnel and organizational subunits, showing their
alignment with the enterprise’s mission and strategic plans.”
Source: NIST SP 800-39

6. 6

7. 7
3 Line of Defense

8. 8
Cloud IAM
1st Line:
Management and
Internal Control

9. 9
Cloud IAM

10. 10
“ who (identity) has what access (role) for which resource.”
Cloud IAM

11. 11
2nd Line:
Security, Risk, and
Compliance

12. 12
Cloud Security Command Center

13. 13
Cloud Security
Command Center

14. 14
3rd Line:
Internal and
External Audit

15. 15
Forseti

16. 16
Forseti Explain
You can use Explain to query and
understand your Cloud IAM policies.
Eg: Use Forseti Explain to determine why
user was granted permission
$forseti explainer why_granted
'user/maliciousUser@dev-tiket.com'
'project/demo-security' --permission
resourcemanager.projects.setIamPol
icy

17. 17
Question?

18. 18
Conclusion

19. 19
Summary
1. Security Architecture
2. 3 Lines of Defense:
a. 1st line: Management and Internal Control
b. 2nd line: Security, Risk, and Compliance
c. 3rd line: Internal and External Audit
3. Tools support: Cloud IAM, Cloud Security Command Center, Forseti

20. Thank You...
20