Enterprise Architecture and Information Security

Information Security &
Enterprise Architecture

Is information security
built-in or add-on
in the
plan, design and execution
of information and communication
systems?

Information Security
Requirements
INFORMATION
MANAGEMENT
INFORMATION SECURITY
Confidentiality Integrity Availability
1. Create
2. Store
3. Utilize
4. Share
5. Dispose

ENTERPRISE ARCHITECTURE
ENTERPRISE
ARCHITECTURE
PRINCIPLES LEGAL TECHNICAL GOVERNANCE
PROCESS
DATA
APPLICATION
TECHNOLOGY

ENTERPRISE
• "Enterprise" is an entity defined and organized
to create value
• The value creation is structured to be
composed of product, services, people,
location, performance, function, process,
data, application, technology, infrastructure
and providers.
johnmacasio@gmail.com

ARCHITECTURE
• Speaks of drawn model to describe
the holistic and particular view of the
system in actualizing the “value”
defined for the organization.
• Blueprint which define the baseline of
common and differentiated
information on how the system is
organized and expected to behave to
actualize the mandate, mission,
principles, vision, goals, objectives
and performance.

Need for Enterprise Architecture

VALUE OF ENTERPRISE ARCHITECTURE
“You are going to do
architecture, because without
architecture, you cannot do
any of these things:
• Alignment
• Integration
• Change
• Reduced Time-to-Market
-John Zachman
Enterprise Architecture Framework

ALIGNMENT
• Enterprise architecture provides the
framework to enable better alignment of
business and information technology
objectives. The architecture used can also
serve as a communication tool.

INTEGRATION
• Enterprise architecture establishes the
infrastructure that enables business rules to
be consistently applied across the
organization, documents data flows, uses and
interfaces.

VALUE CREATION
• Enterprise architecture provides better
measurement of information technology
economic value in an environment
where there is a higher potential for
reusable hardware and software assets

CHANGE MANAGEMENT
• Enterprise architecture establishes consistent
infrastructure and formalizing the
management of the infrastructure and
information assets better enables an
organization-wide change management
process to be established to handle
information technology changes

COMPLIANCE
• Enterprise architecture provides the artifacts
necessary to ensure legal and regulatory
compliance for the technical infrastructure
and environment.
- Schekkerman, J. (2005). Trends in Enterprise Architecture,
Institute for Enterprise ArchitectureDevelopment

ENTERPRISE ARCHITECTURE DOMAIN
TECHNOLOGY
INFRASTRUCTURE
INFORMATION
DATA & APPLICATION
BUSINESS
FUNCTIONS
PROCESS &
POLICIES
ORGANIZATION &
STAKEHOLDERS
MANDATE
VISION
GOALS
PROGRAMS
1. Intention
2. Business
3. Information
4. Technology

ARCHITECTURE DOMAINS
1. BUSINESS ARCHITECTURE
Definition of the business strategy, governance,
organization, and key business processes of the
enterprise
2. APPLICATION ARCHITECTURE
Provision of functional blueprint for the
individual application system to be deployed,
the interaction between application system, and
their relationship to the core business processes
of the enterprise

ARCHITECTURE DOMAINS
3. DATA ARCHITECTURE
Structural definition of the logical and physical data
assets of the enterprise, and the associate data
management resources.
4. TECHNOLOGY ARCHITECTURE
Definition of the hardware, software and network
infrastructure to support the deployment of core
and mission-critical applications. It includes
description of technology standards and
methodology.

ENTERPRISE ARCHITECTURE
COMPONENTS IN ICT SERVICES
USE CASE
APPLICATION
SYSTEM
DATA
SERVICES
APPLICATION
SERVICES
CONNECTIVITY
SERVICES
USERS
ACCESS
BUSINESS
PROCESSES
MEMBERSHIP
COLLECTION
BENEFITS
ACCREDITATION
DATA
ELEMENTS
DATABASE
SYSTEM
NETWORK
INFRASTRUCTURE
POINT OF PRESENCE
CUSTOMER
CLIENTS
PROVIDERS
SUPPLIERS

E
Membership Collection Benefits Accreditation
CUSTOMER RELATIONSHIP MANAGEMENT
ENTERPRISE RESOURCE PLANNING
Planning Audit Risks Legal/Policy
ENTERPRISE PERFORMANCE MANAGEMENT
Finance
Human
Resource
Assets
Facilities
Technology
DATA
APPLICATION
BUSINESS
PROCESS
TECHNOLOGY
INFRASTRUCTURE
CASE: BUSINESS INFORMATION SYSTEM INTEGRATION VIEW
INFORMATION
SECURITY
E
N
T
E
R
P
R
I
S
E
A
R
C
H
I
T
E
C
T
U
R
E

SUCCESS COMPONENTS OF
INFORMATION SYSTEM
Agency
Citizen
DeLone and McLean Model

Enterprise Architecture
Questions
Information
Security
Principles
Information
Security
Risks
Information
Security
Methodology
BUSINESS
FUNCTION
PROCESS
BUSINESS
DATA &
APPLICATION
BUSINESS
TECHNOLOGY
INFRASTRUCTURE
ENTERPRISE
INFORMATION
SECURITY
Information
Security
Governance
NETWORKED INFORMATION
SUPPLIER & CUSTOMER

Information Security Means…
Information
Security
Confidentiality
Availability
Integrity
Secrecy, Privacy and Authority
Accurate, Complete and Reliable
Accessible, Immediate and Uptime

Information Insecurity Means…
StolenMisrepresented
Breached
Information is
not secure
when
something is
Misused
IncompleteUnauthorized
Compromised Denied

CASE: HEALTH INSURANCE
MEMBERSHIP
MANAGEMENT
COLLECTION
MANAGEMENT
BENEFITS
MANAGEMENT
ACCREDITATION
MANAGEMENT
payment
identification
claims
certification

FINANCIAL
MANAGEMENT
PERSONNEL
MANAGEMENT
ASSET
MANAGEMENT
LEGAL
MANAGEMENT

AUDIT
MANAGEMENT
STRATEGY
MANAGEMENT
RISK
MANAGEMENT
PROJECT
MANAGEMENT

INFRASTRUCTURE
MANAGEMENT
NETWORK
MANAGEMENT
APPLICATION
MANAGEMENT
DATA
MANAGEMENT

Mitigating Information
Security Risk
Information
Security
Risk
Mitigation
Assessment
Policy Governance
Technology
Why Who
What How

Security Policy Requirement
Governance
•Functional
Organization
•Roles and
Responsibilities
Competencies
•Knowledge, Skills and
Attitudes Requirements
•Training Program and
Certification
Process
•Business Workflow,
Procedures and Rules
•Risk Audit and Control
Procedures
Data
Infrastructure
•Acceptable Use
•Data Management
•Risk Audit and
Control Procedures
•Infrastructure
Management
•Sourcing &
Procurement
•Risk Audit and
Control
Governance
Guidance and
Implementation
Competency
Reference and
Assessment
Functions
Process
Models and
Control
Guidance
Data and Application
Security Models and
Acceptable Use
Physical Configuration
Network Models
Service Sourcing
Trusted Technology
Acceptable Use
No Need to
Reinvent the Wheel
1. Recognize security needs & question
2. Find the fitted practitioner standards
3. Apply standards to real life condition
4. Assess and improve the practice
Governance
Competency
Process
Data
Infrastructure

Risk Assessment
Information
Asset
Inventory
(Information
Systems)
Risk
Mitigation
Treatment
Prevention
Impact
Rating of
Vulnerability
Identification
Vulnerability
Threat Source
1. Organization
2. Process
3. Data
4. Application
5. Infrastructure

What it means
to secure information…
1. Establish the governance and
management organization of
information security that
comply to best practice
standards.

What it means
2. Identify the information
assets, and perform the
assessment of vulnerabilities
and threats that surround
the creation, storage, use
and sharing of information.

What it means
3. Develop, document and
implement policies, standards,
procedures, and guidelines that
ensure confidentiality, integrity,
and availability in the person,
process, data, application and
infrastructure of information.

What it means
4. Evaluate, acquire and use
security management tools to
classify data and risk, to audit
information system, to assess
and analyze risks in the solution
development and infrastructure,
to monitor and control areas of
vulnerabilities. and implement
security controls and appropriate
reactive responses to threats.

Basic Security Steps
Authorized
Access
Device
Integrity
Data
Exchange
Protocol
Monitoring
& Audit
Network
Hardening
Service
Agreements
Information
Systems
Security
Standards
Risk
Assessment
& Policies
Security
Services
User
Training

CHANGE…
1. We can only evaluate that which
is measurable
2. We can only test that which is
agreed.
3. We can only improve that which
is actualized.
4. We can only change that which
is established.

Enterprise Architecture and Information Security

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (20)

Similar a Enterprise Architecture and Information Security

Similar a Enterprise Architecture and Information Security (20)

Más de John Macasio

Más de John Macasio (20)

Último

Último (20)

Enterprise Architecture and Information Security

Notas del editor