CSA’s Enterprise Architecture: Security and Risk Management (SRM)

Written by CSA’s Enterprise Architecture Working Group.

The Enterprise Architecture is both a methodology and a set of tools that enable security architects, enterprise architects, and risk management professionals to leverage a common set of solutions and controls. It can be used to assess opportunities for improvement, create road maps for technology adoption, identify reusable security patterns, and assess various cloud providers and security technology vendors against a common set of capabilities.

This blog describes the fourth and last domain from CSA’s Enterprise Architecture: Security and Risk Management (SRM). Read about the other three domains: Business Operation Support Services, Information Technology Operation & Support, and Technology Solution Services.

Overview

Security and Risk Management (SRM) is the passwords, firewalls, and encryption that protect computer systems and data. It is the processes that define policies and audit systems against those policies. It uses ethical hackers and tools to test for weak spots in the systems. This is what most people think of when they think of cybersecurity.

SRM provides the core components of an organization’s Information Security Program to safeguard assets and detect, assess, and monitor risks inherent in operational activities. SRM capabilities include: Identity and Access Management; Governance, Risk, and Compliance; Policies and Standards; Threat and Vulnerability Management; and Infrastructure Data Protection.

Example

An employee working from home must log into the corporate VPM using the one-time password token on his key fob. A new website being built is tested for compliance with corporate security policies. A thief cannot read data on a stolen laptop if its hard drive has been encrypted.

Services Provided

Governance and Compliance: Encompasses, integrates, and aligns activities such as corporate governance, enterprise risk management, and corporate compliance with applicable laws and regulations.

Information Security Management: Implements the appropriate measurements to minimize or eliminate the impact that security-related threats and vulnerabilities might have on an organization.

Privilege Management Infrastructure: Ensures users have access and privileges required to execute their duties and responsibilities with Identity and Access Management (IAM) functions such as identity management, authentication services, authorization services, and privilege usage management.

Threat and Vulnerability Management: Deals with core security, such as vulnerability management, threat management, compliance testing, and penetration testing.

Infrastructure Protection Services: Secures server, endpoint, network, and application layers using a traditional defense-in-depth approach to make sure containers and pipes of data are healthy.

Data Protection: Covers all data lifecycle stages, data types, and data states.

Policies and Standards: Specify what type of security and how much should be applied. These are derived from risk-based business requirements and exist at several different levels.

Relation to Other Domains

• SRM provides the security context for IT Operations and Support. Security aspects of ITOS capabilities and functions are critical to the delivery of IT services supporting a business.
• SRM is a key component of Operational Risk Management under Business Operation Support Services, as security risks are crucial data points of the organization’s business intelligence.

Read more in the CSA Enterprise Architecture Reference Guide.