What is a secure enterprise architecture roadmap?
Download as PPTX, PDF2 likes3,494 views
The document discusses secure enterprise architecture and its integration with cybersecurity, emphasizing the need for strong protection mechanisms and compliance with regulations such as GDPR. It explores various security frameworks and technologies, including mutual TLS, hardware fingerprinting, and application whitelisting, alongside the challenges posed by blockchain in relation to current compliance laws. For further inquiries, contact David Morris at his provided email.
What is a secure enterprise architecture roadmap?
- 1. Juanita Koilpillai Chief Technology Advisor Digital Risk Management Institute Mark Rasch Chief Legal Council Digital Risk Management Institute David Morris Early Pioneer in Cybersecurity Managing Partner Morris Cybersecurity What is a Secure Enterprise Architecture Roadmap? Cybersecurity: The No Spin Zone Ulf Mattsson Head of Innovation at TokenEx
- 2. Enterprise Architecture - Based on Operations - Cyber Security permeates every layer Source – Cloud Security Alliance & United Health
- 3. Security Enterprise Architecture Source – NIST - Technology & Policy Focused
- 4. Security Enterprise Architecture Source – ISO 27001 - Audit Focused
- 5. Security Reference Architecture - Dev/Ops Focused Source – AWS
- 6. Example - Security Design - Zero visibility for Critical Applications & infrastructures Clients Don’t allow anything to connect to them Authen cate to the servers(eg. using Mutual TLS) Servers Mutual TLS Use Authoriza on to Elevate Trust (eg. single packet authen ca on Single Packet Mi gate the the of keys (eg. hardware fin g erprin ng) 1 2 3 4 Hardware Fingerprin ng Require authoriza on to ini ate communica on Deny all connec ons 5 6 Use independent communica on port for admins (MFA, Specific IPs) Admins 7 Applica on Whitelis ng Secure Hardware Eg. Hardware Root of Trust Pin comms to the Root Secure Boot Hardened OS File Integrity Monitoring 8 Elements of a protec on mechanism - So ware Defined Perimeter Op onal Users MFA
- 7. Does Blockchain, GDPR, Cloud, and IoT conflict with compliance regulations complicating your SEA? GDPR is not blockchain-compatible the way it is written today. Blockchain data can't be deleted. So will its applications be illegal? • There are ways for Blockchain applications to be compliant - data could be stored off-chain in distributed or cloud-based servers. Cloud considerations • From a storage and compliance perspective, they accumulate information about humans and our interaction with IoT devices. • One of the key questions asked how we make sure this is done in a correct and secure way; as well as how we make sure it is done in compliance with the new EU GDPR, because it’s going to be very hard to track everything.
- 8. For more information about this presentation, contact: David Morris at: David.Morris@Morriscybersecurity.com Cybersecurity: The No Spin Zone