Steve Nimmons

This article briefly introduces the SABSA framework and its importance in the production of Security Architectures using Enterprise Architecture and TOGAF.

Figure 1 – The SABSA Framework

[Source: SABSA – (stylised version below by Steve Nimmons)]

The SABSA (Sherwood Applied Business Security Architecture) framework has evolved as a “best practice” method for delivering cohesive information security solutions to enterprises.

SABSA is a six-layer model covering all four parts of the IT lifecycle: Strategy, Design, Implementation and Management & Operations.

SABSA ensures the security needs of your enterprise are met completely and that security services are designed, delivered, and supported as an integral part of your IT Management infrastructure.

Figure 2 – The SABSA MATRIX

[source: SABSA]

Figure 3 (SABSA and the TOGAF ADM) is a useful way to compare the relationship between the two frameworks at a high level. The SABSA dimensions are principally used to guide creation of the Security Architecture and the production of security aspects of the dependent TOGAF views (Business Architecture, Information Systems Architecture and Technology Architecture).

Figure 3 – TOGAF ADM & SABSA

[Source: Steve Nimmons]

Figure 4 – High-level process for creation of Security Architecture

[Source: Steve Nimmons]

High Level Steps

• Ensure security requirements are considered at inception (including legislation such as Data Protection Act, PCI DSS etc.)
• Create a set of Enterprise Principles (across Business, Data, Application and Technology domains, with a specific focus on security principles and policies)
• Conduct a structured Risk Assessment to determine which assets require protection and the level of controls required
• Create RMADS documentation highlighting the actors, risks and countermeasures required to mitigate the risks
• Develop standard TOGAF views (Business Architecture, Data Architecture, Application Architecture and Technology Architecture), informed by the functional and non-functional requirements and Enterprise Principles. Each of these views will have security aspects
• Implement security architecture view(s) in TOGAF based on SABSA and relevant best practices (e.g. CESG GPG documentation). This set of architectural views focuses on the SABSA dimensions pictured in Figures 2 and 3 (above) and Table 1 (below)
• The Security Architecture should identify the principal Security Enforcing Functions in the architecture and cross-reference them with the countermeasures laid out in the RMADS

Table 1 – SABSA focus areas

Contextual and conceptual security is often rather glossed over, with Security Architecture ‘diving in’ at the Logical View. Application Architectures also need decent security and component architectures, in terms of understanding protocols in use, ports required, deployment options, component interactions, security contexts, resilience etc.

As with TOGAF implementation, the degree of ceremony and tailoring of SABSA should be pragmatic. Security should be proportionate, architectural modelling guided by SABSA should also be proportionate. Structured risk assessment provides the right focus. Cross-referencing between risk assessment, countermeasures in the RMADS (i.e. mitigation of risk) and the actual Security Enforcing Functions in the Security Architecture is important. Laid out well, this really helps with understanding how identified risks are dealt with in the architecture (and at which tier). This is a G-d send for penetration testing and accreditation.

Related Posts:

• Exploring the fit between VPEC-T and Enterprise Architecture
• 5 Enterprise Architecture Picks
• Policy Enforcement Point Pattern
• Future Proofing your Enterprise Architecture Principles
• Anti Pattern: Below the Radar