I was engaged in a minor workshop together with a bunch of security architects to work out a problem why it was to challenging to implement a new security architecture. No matter the document, workshops etc. they did nothing stuck. New solutions not following the architecture popped up all over the place and the architects had to spend more time fixing things or bolt on old technology rather than steer the security in the right direction.<\/p>\n
We started looking at their processes and they were sound enough following my security architecture lifecycle to the letter with very clear risk analysis and threat modelling going on as it should. We started to look at their security mechanisms and they was lacking a bit in clarity but the list of preferred functions was adequate but a could have had more details in how to implement them. Third point was the reference architectures they used and those was very high level but valid to the environment. Then I found the culprit: patterns. They had not fully understood how to create patterns. Instead of building patterns in the form of authentication pattern, identity usage pattern, secure server etc. they had built lists of mechanisms that was to be implemented but without the technical guidance that must come along it. You cannot provide a list with:
\n1.\tYou must comply with the password rules defined in document 1.
\n2.\tYou must authenticate the users according to document 2 using the prescribed protocols.<\/p>\n
When coming to the patterns you must define the technology AND have a designer create detailed patterns and preferably ready made building blocks to be used if you are not providing detailed guidance to the development teams.<\/p>\n
I helped them create a few patterns so that they grasped the principle and we will have a follow-up in a few months to see if that solved their problem.<\/p>\n","protected":false},"excerpt":{"rendered":"
I was engaged in a minor workshop together with a bunch of security architects to work out a problem why it was to challenging to implement a new security architecture. No matter the document, workshops etc. they did nothing stuck. New solutions not following the architecture popped up all over the place and the architects […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-969","post","type-post","status-publish","format-standard","hentry","category-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=969"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/969\/revisions"}],"predecessor-version":[{"id":970,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/969\/revisions\/970"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}