security architecture

Cloud Compromise: Risks of Limited Cloud Visibility

November 8, 2020 by ars5522 Leave a Comment

As cloud adoption increases concerns of traditional security issues are decreasing, putting a greater emphasis on risks that are results of senior management decisions than cloud service provider responsibilities. Enterprises are maturing their understanding and usage of cloud computing, making control plane weaknesses and meta-structure or appli-structure failures greater risks than service level vulnerabilities (CSA, 2020). These issues are exasperated when enterprises have limited cloud visibility.

There are two key challenges to establishing the ability to visualize and analyze whether cloud service use is safe or malicious. The Cloud Security Alliance details these as un-sanctioned app use and sanctioned app misuse. At a high level, the concern of these challenges is if the use of cloud resources is in line with corporate policies and how are they being used. Taking into consideration systems governance, user awareness of policies, and security controls (CSA, 2020). Microsoft’s Continuous Cloud Optimization dashboard (Links to an external site.) is a great example of this, providing a single pane of glass into implemented cloud infrastructure, security, and governance. Regulatory bodies are also working to standardize around these needs with specifications like ISO 27001, COBIT, and NIST 800-53 (ISACA, 2012). All which operate around four guiding principles:

Vision—What is the business vision and who will own the initiative?
Visibility—What needs to be done and what are the risks?
Accountability—Who is accountable and to whom?
Sustainability—How will it be monitored and measured?

By modeling enterprise cloud visibility systems around these four principles, leaders enable:

Cloud oversight
Risk ownership
Knowledge needs
Access control
Maturity state
Compliance

(ISACA, 2012)

Controlling cloud security starts from the top down. A responsible and inclusive culture is necessary to sustain the integrity of enterprise cloud solutions. People, process, and technology all need to be in sync to mitigate risks. Industry standards are helpful in setting guidelines for your enterprise, but standards are useless if decision makers cannot visualize and analyze the current state of their organization. Establish a framework for evaluating risk and progress through the Vision, Visibility, Accountability, and Sustainability principles to develop viewpoints of your enterprise’s needs.

References

Azure. (n.d.). Azure/ccodashboard. Retrieved from https://github.com/Azure/ccodashboard (Links to an external site.)

CSA. (2020) The egregious 11: Top threats to cloud computing. Cloud Security Alliance (CSA). Retrieved from https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-deep-dive/ (Links to an external site.)

ISACA. (2012, September). Cloud risk—10 principles and a framework for assessment. Information Systems Audit and Control Association (ISACA). Retrieved from https://www.isaca.org/resources/isacajournal/past-issues/2012/cloud-risk-10-principles-and-a-framework-for-assessment

The Shifting Perspectives of Enterprise Security

July 6, 2020 by ars5522 Leave a Comment

It’s interesting to learn how the focus of enterprise security has changed with the evolution of technology. Traditionally information security was focused on hardening technology implementations and establishing solutions that fit business needs but don’t hinder business processes. Now that security technology is maturing the focus is more management oriented; wanting to be proactive in security decisions and solutions over reactive. For instance, expanding controls to secure business operations instead of just securing the technical point of data ingress and egress. This has caused a change in perception as well, security faults become a manager problem instead of a system problem. Moving the fault from systems failure to the larger process that allowed the fault to occur.

EA is a great tool for managing these complexities. Fujitsu’s Enterprise Security Architecture is an example of this with a proactive security architecture that creates a systematized view of the organizations security approaches. Resulting in an effective and efficient security investment with clearly communicated requirements.

Public clouds also help manage this with plug and play ready security solutions. Reducing the cycles required to solve for vulnerabilities. While also taking basic security responsibilities off of the enterprises hands and into the cloud provider, but EA is still necessary to ensure every layer of the enterprise is aligned and working with chosen security solutions.

References:

Shiozaki, T. (2007). Fujitsu Enterprise Security Architecture. Fujitsu Information Security Center.

EA and Security

July 6, 2020 by ars5522 Leave a Comment

Enterprise security needs to be a core tenant of any enterprise architecture (EA). Many EA frameworks include security as a layer of the enterprise but it needs to be more than a domain of artifacts. Security architecture (SA) needs to be ranked as a priority in strategic planning to ensure proper alignment of enterprise decisions. Security controls are integrated across all enterprise layers, without alignment there is probability of duplicate solutions and redundant costs.

The problem is that many organizations struggle to integrate security into their EA due to the high specialization of the field. To curb disconnects between EA and SA, enterprises should work to align the structure and methodology of their SA with the structure and methodology of their organization’s EA. This means selecting tools that accommodate everyone’s needs, training people, and fostering collaboration. Using architectural principles to improve consistency, business alignment, and reuse in the organization’s security programs.

Establishing a holistic views that includes process, policy, people and technology with security will create a business architecture that can appropriately respond to and plan for threats. Allowing EA to drive business outcome goals ready for a digital world.

References:

Scholtz, T. (2008) Aligning Security Architecture and Enterprise Architecture: Best Practices. Gartner.

OPINION: IT, Business, or Security..which comes first in a Digital Enterprise?

July 4, 2020 by ars5522 2 Comments

Digital transformations are changing the relationships between enterprise domains. Traditionally Business Strategy and requirements dictate IT Strategy which in turn dictates Security Strategy. However, in a digital first world should IT strategy be a response to business strategy? As shown in Figure 1, there is a logical flow to the traditional design of enterprise development where security architecture and IT strategy are both a response to the business. However, in this model security architecture is a sub domain of IT architecture.

Figure 1 – Enterprise domain relationships

I argue that in the modern world security architecture (SA) needs to be a first class citizen. SA is derived from multiple drivers – financial, risk Management, benchmarks, and legal/regulations. While aligned to IT architecture, it needs to have it’s own major Security Strategy to influence business and IT decisions. SA should have authority to influence strategic business direction, providing insight on initiative risk. Allowing security evaluations to grow beyond control cost, regulatory need, and the ever famous industry standard. There is also merit for SA remaining a subset of IT architecture as implementations need to integrate with existing and planned solutions, but there should be authority given here as well for SA to influence IT decisions. Guiding strategy with risk aware solutions and archiecture with capability risk analysis.

References:

Thorn, A. Christen, T. Gruber, B. Portman, R. Ruf, L. (2008) What is Security Architecture?. Information Security Society Switzerland.