crowmoor.se

Working as a security architect means that I sometimes need to explain what I work with. I many times get the question: ‘Do you make architectures for security technology like IAM and Firewalls?’ The answer is always ‘Yes but…’ So the real question is: ‘What is “but…”?’

To be able to create a security architecture you need to understand what security really is. Security is only a property on everything meaning that whenever you create a functional architecture like a network or new process you have to make sure that you manage security. Simple as that? No.
What is security when it comes to architecture? Security is all about managing risks and those risks could be managed in different ways with different results and costs but all of them do mitigate the risk. So before you start to create your functional architecture you need to conduct a risk analysis making sure to understand what the risks are. Then you could apply security in your architecture. But…

How much security? Well, that is for me to know and you to learn. ? You have to do an asset valuation to understand the value of the things you are protecting; be it the total value of the company or just a number or credit cards stored on a server. When you know the value you know how much security you need.

And that is all? Almost. You may probably come up with different solutions in the different aspect areas: Business, Information, Information System or Technical Infrastructure. Being able to select either one means that you need to understand the effectiveness of your security mechanisms and the costs of implementing them. Using ROSI (Return Of Security Investment) as an KPI means that you have a tool that helps you select the best security architecture for your client.