SACON - Enterprise Security Architecture (Bikash Barai)
•
4 likes•2,608 views
SACON - Enterprise Security Architecture (Bikash Barai)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (15)
Similar to SACON - Enterprise Security Architecture (Bikash Barai)
Similar to SACON - Enterprise Security Architecture (Bikash Barai) (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
SACON - Enterprise Security Architecture (Bikash Barai)
- 2. SACON Enterprise Architecture • A field born about 30 years ago • Initially targeted to address two problems • System complexity • Inadequate business alignment • Resulting into • More Cost, Less Value
- 3. SACON Enterprise Architectural Methodologies • Consortia-developed Frameworks • ISO 19439 • RM-ODP (ITU-T X.901-904) • TOGAF • Defense Industry Framework • DoDAF • MODAF • NAF • Government Framework • ESAAF • FEAF • NIST Enterprise Architecture Model • Open Source Frameworks • TRAK • SABSA • Proprietary Frameworks • Zachman Frameworks • IAF (Capgemini, 1993)
- 5. SACON SABSA
- 6. SACON Challenges with existing models • Too heavy to be intimidating - Too many steps • Cannot be done incrementally – Needs big bang approach • Very few SABSA professionals and very few implementation • Does not produce a prioritized list of security activities
- 7. SACON Goodness Criteria • Should help to eliminate • Should help to focus • Should be simple • Should be easy to remember
- 9. SACON Goals of CP-SSM • Light • Minimalist • Focused
- 10. SACON Steps • Create Business Architecture (High Level) • Strategic Threat Modeling • Elimination: Bucket and Prune • Mapping: Threats to 4 types of controls • Priority Bucketing of Activities
- 11. SACON Key Elements • CP- Threat Repository • Threat Prioritization Guideline – Available • Benchmark, Risk Management Model • CP - Control Repository – Not available • CP- Threat to Control Map – Not available • CP- Activity/Control Priority Map
- 12. SACON Threat Repository • Taxonomy • Software (26 sub class) • Hardware (3) • Physical Security (3) • Supply Chain (2) • Human (3) • Industry or vertical specific top N listing
- 13. SACON CISO Platform Threat – Control Map • Threat: SQL Injection Attack • Detection: WAF, SAST, DAST, IAST, RASP • Prevention: Secure Coding, WAF, RASP • Response: SIEM, SOC Response Process • Prediction: TI (External and Internal)
- 14. SACON Prioritization Matrix Prevention Detection Response Prediction High Risk 1 1 2 3 Medium Risk 2 2 2 3 Low Risk 3 3 3 3
- 15. SACON Next Steps • Utilize the model (loosely) for building an Appsec Program - Post Lunch • Create Community Projects • Threat Repository (Comprehensive + Top N) • Threat Control
- 16. SACON SACON International 2017 India | Bangalore | November 10 – 11 | Hotel Lalit Ashok NIST CSF
- 21. SACON Function Unique Identifier Function Category Unique Identifier Category Subcategory Informative References ID Identify ID.AM-1 Asset Management Physical devices within the organization are inventoried • CCS-CSC1 • COBIT 5 • ISA-62443-2- 1:2009 ID.AM-2 Asset Management Software Platforms and Applications within the organization are inventoried • CCS-CSC1 • COBIT 5 • ISA-62443-2- 1:2009 Structured example
- 23. SACON Maturity levels – Based on NIST CSF • Tier 1 – Partial • Cybersecurity risk management practices are not formalized, and risk is managed in an ad hoc and sometimes reactive manner. • Prioritization of cybersecurity activities may not be directly informed by organizational risk objectives, the threat environment, or business/mission requirements. • Tier 2 – Risk Informed • Risk management practices are approved by management but may not be established as organizational-wide policy. • Prioritization of cybersecurity activities is directly informed by organizational risk objectives, the threat environment, or business/mission requirements. • Tier 3 – Repeatable • Risk management practices are formally approved and expressed as policy. Organizational cybersecurity practices are regularly updated based on the application of risk management processes to changes in business/mission requirements and a changing threat and technology landscape. • Tier 4 – Adaptive • Adapts its cybersecurity practices based on lessons learned and predictive indicators derived from previous and current cybersecurity activities. • Through a process of continuous improvement incorporating advanced cybersecurity technologies and practices, the organization actively adapts to a changing cybersecurity landscape and responds to evolving and sophisticated threats in a timely manner. Private & Confidential
- 24. SACON Framework profile • Presents overview of present and future cybersecurity posture • Business Requirements • Risk Tolerance • Resources • Used to define current state and desired state • Can help measure progress...
- 27. SACON FireCompass Score (34 / 100) - Sample Maturity levels • Tier 4: Adaptive • Tier 3: Repeatable • Tier 2: Risk Informed • Tier 1: Partial Identify Protect Detect Respond Recover Devices Tier 2 Tier 2 Tier 2 Tier 2 Tier 1 Applications Tier 2 Tier 2 Tier 1 Tier 1 Tier 1 Networks Tier 1 Tier 1 Tier 1 Tier 1 Tier 1 Data Tier 1 Tier 2 Tier 1 Tier 1 Tier 1 Users Tier 1 Tier 1 Tier 1 Tier 1 Tier 1 Private & Confidential
- 29. SACON BeyondCorp