The Secure Arc Reference Architecture

From The Secure Arc Wiki

(Difference between revisions)
Jump to: navigation, search
m (Formatted the category better)
Line 1: Line 1:
-
Secure Arc provide a basic conceptual framework aimed at helping to solve complex security architectural design and decision making issues. Refer to [[The Secure Arc Methodology]] to see how to leverage these concepts and tools as part of a typical software development life-cycle.
+
Secure Arc Reference Architecture consists of a basic conceptual framework aimed at helping to solve complex security architectural design and decision making issues.
-
Each of the concepts making up the Secure Arc Framework are identified below.
+
Each of the concepts making up the Secure Arc Reference Architecture are identified below.
{| class="wikitable"
{| class="wikitable"
Line 8: Line 8:
!
!
! Description
! Description
-
|-valign="top"
 
-
| [[Image:IA-Classification.png|100px]]
 
-
| [[Information Asset Classification]]
 
-
| Ultimately, the goal of a Security Reference Architecture is to protect the Assets of an organisation. The Information Asset Classification of these assets form the basis of what needs to be protected, how and to what level.
 
|-valign="top"
|-valign="top"
| [[Image:Principles.png|100px]]
| [[Image:Principles.png|100px]]
| [[Security Principles]]
| [[Security Principles]]
-
| Almost all aspects of the reference architecture are driven by the fundamental Security Principles.
+
| Almost all choices and decisions made while following the Security Reference Architecture are driven by the fundamental Security Principles.
|-valign="top"
|-valign="top"
-
| [[Image:Policy-Image.png|100px]]
+
| [[Image:ZoneModel.png|100px]]
-
| [[Security Policies and Standards]]
+
| [[Logical_Security_Zone_Pattern|Logical Security Zone Model]]
-
| Most Security Policies and Standards that corporations need to adhere to are driven by these principles.
+
| The Logical Security Zones provide an intuitive means of laying out an appropriately partitioned infrastructure based on the Levels of Trust and a concisely defined set of rules for how Nodes are allowed to communicate across Zones.
 +
|-valign="top"
 +
| [[Image:SecurityControlsDetail.png|100px]]
 +
| [[Security Controls]]
 +
| The Security Controls Model enables the complete end-to-end traceability between Information Assets that are stored or processed by the Infrastructure Assets and the decisions behind the Security Controls that are employed to protect them.
|-valign="top"
|-valign="top"
| [[Image:JigSawPiece.png|100px]]
| [[Image:JigSawPiece.png|100px]]
Line 25: Line 25:
| Design Patterns ultimately provide proven approaches for satisfying the Security Principles and consequently the associated Policies and Standards.
| Design Patterns ultimately provide proven approaches for satisfying the Security Principles and consequently the associated Policies and Standards.
|-valign="top"
|-valign="top"
-
| [[Image:ZoneModel.png|100px]]
+
| [[Image:Policy-Image.png|100px]]
-
| [[Logical_Security_Zone_Pattern|Logical Security Zone Model]]
+
| [[Security Policies and Standards]]
-
| The Logical Security Zones provide an intuitive means of laying out an appropriately partitioned infrastructure based on the Levels of Trust and a concisely defined set of rules for how Nodes are allowed to communicate across Zones.
+
| The majority of security controls put in place in most organizations are largely driven by the Security Policies and Standards that are dictated either by the organization itself or regulatory bodies.
-
|-valign="top"
+
-
| [[Image:ThreatModelTable.png|100px]]
+
-
| [[Threat Model]]
+
-
| By systematically identifying and classifying threats, we can clarify risk, and focus effort on the areas that need it most, with a goal to prevent loss.
+
-
|-valign="top"
+
-
| [[Image:ArchitecturalDecisions.png|100px]]
+
-
| [[Architectural Decisions]]
+
-
| The process of identifying and assessing the risk of potential threats to the Information Assets exposed in a system will ultimately result in a number of Architectural Decisions driven by the Value at Risk, the Level of Risk, the Cost of the Countermeasures proposed to mitigate those Risks and the Residual Risk remaining after the Countermeasures have been applied.
+
|}
|}
-
===Navigation===
 
-
* [[Secure_Arc_Reference_Architecture|Back to The Secure Arc Reference Architecture]]
 
-
* [[The_Secure_Arc_Methodology |On to The Secure Arc Methodology]]
 
[[Category:Reference Architecture v.1.0]]
[[Category:Reference Architecture v.1.0]]

Revision as of 02:36, 6 February 2009

Secure Arc Reference Architecture consists of a basic conceptual framework aimed at helping to solve complex security architectural design and decision making issues.

Each of the concepts making up the Secure Arc Reference Architecture are identified below.

Concept Description
Security Principles Almost all choices and decisions made while following the Security Reference Architecture are driven by the fundamental Security Principles.
Logical Security Zone Model The Logical Security Zones provide an intuitive means of laying out an appropriately partitioned infrastructure based on the Levels of Trust and a concisely defined set of rules for how Nodes are allowed to communicate across Zones.
Security Controls The Security Controls Model enables the complete end-to-end traceability between Information Assets that are stored or processed by the Infrastructure Assets and the decisions behind the Security Controls that are employed to protect them.
Design Patterns Design Patterns ultimately provide proven approaches for satisfying the Security Principles and consequently the associated Policies and Standards.
Security Policies and Standards The majority of security controls put in place in most organizations are largely driven by the Security Policies and Standards that are dictated either by the organization itself or regulatory bodies.
Personal tools