SABSA Implementation(Part III)_ver1-0
Download as PPTX, PDF9 likes3,723 views
This document discusses strategies for implementing the SABSA framework for security architecture. It outlines aligning various frameworks and methods such as risk management, controls, performance reporting, and defense in depth layering with SABSA. A multi-tiered controls strategy is described that provides proportional capabilities to deter, prevent, contain, detect, track, and recover from risks. This strategy models controls against risk assessments to determine the appropriate control response based on risk proportionality.
SABSA Implementation(Part III)_ver1-0
- 3. Scope: Strategy & Planning Phase - Process
- 4. Alignment, Integration & Compliance Strategy • Understand what needs to be aligned, to what purpose, and where it is positioned within the SABSA framework • Business model or business process framework • Legislation, regulation or governance frameworks • Risk management methods, assurance framework or audit approach • IT Architecture framework or method • Controls framework, library or standard • Performance management & reporting framework • Etc.
- 5. Strategy & Planning Phase Alignment
- 6. Risk Management Method Alignment
- 7. Performance & Reporting Methods
- 8. Control Objectives Libraries & Standards
- 9. Controls Frameworks & Libraries
- 10. Generic Defense in Depth Layering
- 11. SABSA Defence-in-Depth Principles • No single point of failure • The architectural structure of the controls set improves security – The value of the whole is greater than the sum of the individual parts – Combinations of sensible measures in a collection of well designed control domains can deliver reasonable security • Without ‘rocket science’ • Without over-expenditure – The control domain structures themselves add value to overall security
- 12. Multi-tiered Controls Strategy - Capabilities • Over-investment in preventative measures results in prevention of business and opportunity • SABSA multi-tiered control strategy provides assurance of security capabilities (in design or in review/audit): – Risk-proportional capability to Deter – Risk-proportional capability to Prevent – Risk-proportional capability to Contain – Risk-proportional capability to Detect – Risk-proportional capability to Track – Risk-proportional capability to Recover – Risk-proportional capability to Assure the other capabilities
- 13. SABSA Multi-tiered Control Strategy
- 14. Application of Multi-tiered Controls In Risk • The multi-tiered controls strategy is modeled against the risk assessment to determine proportional and appropriate response • Contributes to selection of the right control in the right place at the right time • Enables further removal of subjectivity in selection of Risk Treatments • Facilitates construction of databases and risk management tools that respond to definitive risk scenarios with definitive control decisions • Increases speed and ease of use of Risk Assessment
- 15. Application of SABSA Multi-tier Control
- 16. Application of Multi-tiered Control Strategy
- 17. END OF PART III