1. The role of security
architecture in managing
information risk in large
scale retail enterprises
presentation for London School Of Economics
by Vladimir Jirasek
28th January 2009

2. Disclaimer

3. Disclaimer
The information included in this
presentation represents personal
opinions of the presenter
and not Tesco plc.

4. Today we will cover...
• What information security architecture is
• Value of security for business
• Practical examples from a retail
organisation
• And finally your questions ...

5. Real story
• On-line bank
• Telecommunication company
• Government

6. Real story
• On-line bank
• Telecommunication company
• Government

7. (information)
Architecture is ...
• Activity to oversee building of business
processes in controlled way
• Covers people, processes, information,
technology
• Supports organisation to manage business
risks

9. Business benefits
• Measuring and prioritising business
risks
• Adding value to the core product
• Empowering customers
• Protecting relationship and leveraging
trust
• Information Security as a business
enabler

10. Business enabler?
• Enable business to provide services to
customers or partners in secure way
• Utilise new technologies
• Internet (1.0, 2.0, …)
• Outsourcing of IT operations
• Remote access for B2B
• Digital medial delivery
• Improving customer services

11. Architecture principles
• Start with business
requirements
• Progress to
Information
Architecture
• Deliver with
technology and
processes Source: Wikipedia

12. Magic triangle
Security
Cost Usability

13. Magic triangle
Security
Cost Usability

14. Magic triangle
Security Cost Usability
Importance of objectives - Military

15. Magic triangle
Security Cost Usability
Importance of objectives - Bank

16. Magic triangle
Security Cost Usability
Importance of objectives - Retail

17. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

18. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

19. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

20. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

21. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

22. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

23. What we protect
Classification Threats Vulnerabilities
Assets
Compliance Technology People

24. Risk of risk management
• Risk can be
calculated as:
• Asset value
• Impact of threat exploiting
vulnerability
• Likelihood of event
Problems:
•asset business value
•likelihood

25. LEVEL OF HARM
A B C D E
Extremely Very No
Appropriate serious serious Serious significant
NATURE OF HARM harm harm harm Minor harm harm
measure
Financial loss Loss of sales, £10 + million £1 - 10 million £100 thousand £10 - 100 £0 - 10
(loss of sales, orders or orders or - £1 million thousand thousand
contract., unforeseen costs, contracts
legal liabilities, fraud)
Loss of tangible £10 + million £1 - 10 million £100 thousand £10 - 100 £0 - 10
assets (eg - £1 million thousand thousand
fraud, theft of
money, lost
interest)
Penalties/Legal £10 + million £1 - 10 million £100 thousand £10 - 100 £0 - 10
liabilities (eg - £1 million thousand thousand
breach of legal,
regulatory or
contractual
obligations)
Depressed 25%+ 11% to 25% 6% to 10% 1% to 5% Less than 1%
share price (eg
SUdden loss of
share value)
Degraded performance Key targets 10%+ 5% to 10% 1% to 5% Less than 1% No impact
(failure to achieve targets, loss under-achieved
of productivity) by:
Number of 10,000+ 1,000 to 10,000 500 to 1,000 100 to 500 0 to 100
staff-hours staff-hours staff-hours staff-hours staff-hours staff-hours
wasted:
Loss of management control Key records not 1 month+ 1 to 4 week Few days Few hours Little delay, no
(over key financial, health or up-to-date or delay, all delay, many delay, some delay, a few wrong entries
safety risks) accurate: entries wrong entries wrong entries wrong entries
unreliable
Impaired Severe loss of Serious loss of Significant loss Moderate loss Minor loss of
Decision control control of control of control control
Making

27. Soft shell is bad...
• Relying on outer
defences
• We have firewall -
we must be secure!
• Insiders? What
insiders?
• Mostly technology
oriented

28. Soft shell is bad...
• Relying on outer
defences
• We have firewall -
we must be secure!
• Insiders? What
insiders?
• Mostly technology
oriented

29. Replaced by an onion
• Inside threats are as
bad outside?
• Data should protect
itself - carry
security
information
• Compliance and
best practice
frameworks

30. How we do it
Enterprise
Business IT security
policy
drivers architecture
framework

31. Business driven
architecture
Enterprise policy IT security
Business drivers
framework architecture
External Policies Enterprise level
• Laws and regulations • Information security • Security domain
(DPA, FSA, PCI) strategy principles
• Best practices (ISO, • Information security • Access control
CobiT, ISF, TOGAF, policy and • Vulnerability
SABSA) governance management
• Technical standards • Risk management • Risk management
(NIST, SANS, CIS) policy • Operational security
Internal • Data protection Solution
• Strategy policy architecture
• Cost • End user policy
• Authentication
• Usability • IT Security policy
• Logging and
• Security Standards monitoring
• Configuration and • PKI
hardening standards • other detailed SAs

32. Measure value added
• ROI or ROSI (why confuse?)
• KPIs used to measure value of security
controls

33. topics for discussion
1. Is security a business
enabler or prevention in
your organisation?
2. Issues with measuring
ROI on security.

34. Contact
Vladimir Jirasek
vladimir@jirasek.eu
LinkedIn