The document discusses building an effective security architecture program at scale. It outlines a 5-phase approach to establish a control framework: 1) inventory controls, 2) assess compliance, 3) measure risk, 4) map to frameworks, and 5) govern controls. The document also provides examples of artifacts like a control catalog, cost-benefit analysis, and compliance targets to help plan capabilities to address program weaknesses and align with business strategies. The 10-step approach puts these pieces together to establish an ongoing security architecture program.

1. Architecture at Scale
Save time. Reduce spend. Increase security.
Ryan Elkins
@the_ryan_elkins
ryan-elkins@outlook.com

2. Agenda
• Build a security architecture program that will work effectively.
• Why it is important.
• Why it is a challenge.
• What not to do.
• What to do.
• How to automate it.

3. IT IS ESSENTIAL TO UNDERSTAND THE
SIGNAL IN A WORLD OF NOISE.
Image credit: http://galleryhip.com/lighthouse-wallpaper-storm.html

4. Vendors say that you need this.

5. Without strategy, you want this.

6. You evaluate current budgetary allocations.
5%
10%
30%
35%
15%
20%
10%
3%
Data Protection
Access Protection
Endpoint Protection
Network Protection
Vulnerability Management
Monitoring and Incident Response
Governance, Risk, Compliance, Architecture
Awareness and Strategy

7. You realize you can afford this.

8. Your boss expects this.

9. You actually need this.

10. YOU CANNOT BUY SECURITY

11. WHERE DO YOU BEGIN?

12. Everything must begin and end with risk.
Risk = Likelihood x Impact

13. Look at your business – understand the impact.
• What is most critical to the business?
• Is it service driven where availability is critical?
• Is it customer data driven where data records are critical?
• Is it product driven where blueprints and trade secrets are critical?
• How can these most critical areas be impacted (threats)?

14. Look at the news – understand the threat.
• Have other companies within the same industry been affected?
• How did the data breaches occur?
• What was stolen or compromised?
• Are the correct controls in-place to prevent the same thing from happening?
• Do nation states, competitors, hacktivists, or cyber criminals have a motive to target the company?

15. Look at your program – understand the exposure.
• Do the initiatives align and support the business?
• Is the program focused on the correct areas?
• Are there any major vulnerabilities or control gaps?
• Is there leadership support for the program?

16. OK, GREAT. NOW I REALIZE THAT:
Impact = Company would go out of business if a breach occurs.
Threat = Our intellectual property is worth billions. Everyone wants it.
Exposure = We think there are gaps, but not really sure.

17. WE DO HAVE OPTIONS:

18. WE DO HAVE OPTIONS:
1. WE THROW IN THE TOWEL.

19. WE DO HAVE OPTIONS:
1. WE THROW IN THE TOWEL.
2. WE BURNOUT AND CHANGE FIELDS.

20. WE DO HAVE OPTIONS:
1. WE THROW IN THE TOWEL.
2. WE BURNOUT AND CHANGE FIELDS.
3. WE GET A CONSULTING JOB TO TELL OTHERS
HOW BAD THEIR SECURITY IS.

21. 3 REASONS WHY PEOPLE, PROGRAMS,
AND COMPANIES FAIL
*I did not join the security field to lose.

22. Failure to see.

23. Failure to act.

24. Failure to finish.

25. Why architecture fails.
• The cart comes before the horse.
• Most programs begin operational and then introduce architecture.
• Isolation from the business, IT, and the rest of Information Security
• There is too much complexity at once:
• SABSA, DoDAF, TOGAF, MODAF, OSA, Zachman, CEB
Architecture must
be viewed as a
transformational
function.

26. Establish the architecture
• The core architecture must:
• Be agile to support change.
• Visionary to support enterprise strategy.
• Reasonable to support adoption.

27. Control
Control Framework - Phase 1
Reference ID (1)
Domain
Category
Description
Status
Phase 1

28. StrengthControl
Control Framework – Phase 2
Reference ID (1)
Domain
Category
Description
Status
Documented (1)
Operational (2)
Monitored (3)
Governed (4)
Phase 1 Phase 2

29. MeasurementStrengthControl
Control Framework – Phase 3
Reference ID (1)
Domain
Category
Description
Status
Documented (1)
Operational (2)
Monitored (3)
Governed (4)
No Risk (0)
Low Risk (1)
Medium Risk (2)
High Risk (3)
Critical Risk (4)
Coverage (%)
Phase 1 Phase 2 Phase 3

30. MappingMeasurementStrengthControl
Control Framework – Phase 4
Reference ID (1)
Domain
Category
Description
Status
Documented (1)
Operational (2)
Monitored (3)
Governed (4)
No Risk (0)
Low Risk (1)
Medium Risk (2)
High Risk (3)
Critical Risk (4)
Coverage (%)
Framework
Internal Reference
Policy
Threat (1)
Technology (1)
Phase 1 Phase 2 Phase 3 Phase 4

31. MetricsMappingMeasurementStrengthControl
Control Framework – Phase 5
Reference ID
Domain
Category
Description
Status
Implemented (1)
Documented (2)
Operational (3)
Monitored (4)
No Risk (0)
Low Risk (1)
Medium Risk (2)
High Risk (3)
Critical Risk (4)
Coverage (%)
Framework
Internal Reference
Policy
Threat (1)
Technology (1)
Control Maturity
Domain Maturity
Technology Coverage
Control Value
Technology Value
Threat Coverage
Phase 1 Phase 2 Phase 3 Phase 4 Phase 5
Governed (5)

32. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

33. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

34. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

35. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

36. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

37. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

38. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

39. User acceptance
Strategic statements
to establish
expectations and
direction.
Consumable security services
Repeatable, pre-approved solutions widely
available for consumption to comply with a
collection of standards.
Instructions to implement and comply with standards.
Strength factors applied to controls based on data classification, risk
severity, threat levels, and regulatory implications.
Foundational security building blocks to reduce risk.
Policies
Principles
Service Catalog
Patterns
Procedures
Standards
Controls
Architecture-at-scale

40. Example Artifacts

41. Phase 1 Control Catalog
• Inventory and categorization of controls.
• Tracking the compliance of controls will highlight the utilized capabilities.
• Control mappings will formalize resource dependencies.
Ref # Domain Category Control Status
AC 1 Identity and Access
Management
Authentication Password policies must include length and
complexity.
Core
SA 1 Awareness Training Users must not use email for non-business use. Core
DS 1 Data Protection Data Classification Databases containing highly sensitive elements
must be monitored.
Emerging
NS 1 Endpoint Security Mobile Mobile devices must be managed when accessing
data.
Investigational

42. Cost benefit analysis.
5
7
11
6
16
1
4
2$2
$12
$8
$9
$3
$7
$20
$8
0
5
10
15
20
25
EndPoint Wall Data Shield Awareness Training Guardrail Proxy Vuln Master Edgeline Broker Compliance Central Malware Destroyer
Control Count
Cost

43. Establish target goals.
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Data Protection
Access Protection
Endpoint Protection
Network Protection
Vulnerability Management
Monitoring and Incident Response
Governance, Risk, Compliance, Architecture
Awareness and Strategy
Compliance Tracking
Percent Compliant Target Level

44. Capture the program weaknesses.
• Evaluate the gaps against internal business risk.
• Analyze breaches and industry threats.
• Engage independent third-party assessors.
• Combine the information to develop a short-term and long-term strategy.

45. Plan for the needed capabilities.
• Balance the spend based on the risk.
• Invest in the program gaps.
• Align with the business strategy to plan for emerging risks.
• Determine the total cost of ownership for a short-term and long-term strategy.

46. Strategy distribution.
• Provide the overarching strategic capability goals across the leadership.
• Prioritize the focus.
• Develop tactical milestones and initiatives for completion taking into account
people, process, and technology.
• Continually track execution status through delivery.
• Transition completed capabilities into ongoing governance.

47. Putting the pieces together.
1. Understand the business strategies.
2. Analyze the threat landscape.
3. Identify the existing program capabilities.
4. Determine what is most important to protect (the crown jewels).
5. Establish the program framework.
6. Map the controls to the capabilities.
7. Perform cost benefit analysis.
8. Set goal compliance targets.
9. Compile the short and long term strategy.
10. Develop the tactical milestones and track to completion.
Repeat this process annually.

48. A tool to help you succeed.
• Security Marker – securitymarker.io
• Populate the data into pre-made spreadsheet.
• Load the spreadsheet into the webpage.
• Javascript will process the data and output D3.js visualizations.
• Everything stays completely client side so no sensitive data is transmitted.

49. Thank you!
Contact Information
ryan-elkins@outlook.com
Twitter: @the_ryan_elkins