The SABSA White Paper (W100) Overview
The SABSA White Paper details SABSA® as a methodology for developing risk-driven enterprise security architecture and information assurance architectures and for delivering security infrastructure solutions that support critical business initiatives. It is an open standard, comprising a number of frameworks, models, methods and processes, free for use by all, with no licensing required for end-user organisations who make use of the standard in developing and implementing architectures and solutions.
This SABSA White Paper explores the advantages of this business-focused approach for creating security architecture. It discusses the pitfalls of a technology-centric approach and recognises the challenges of integrating the business leadership team with the technology strategists in order to fulfil the potential of the enterprise.
The SABSA White Paper also discusses the SABSA methodology, explaining this approach by comparing it to the classical definition of architecture (i.e., the construction of buildings). By illustrating the contextual, conceptual, logical, physical, component and service management layers of the architectural process, a comprehensive approach unfolds that provides a roadmap for business and ICT (information and communications technology) leadership teams to follow so as to ensure that the technology foundation becomes an enabler of business performance.
Unless the SABSA security architecture can address a wide range of operational requirements and provide real business support and enablement, rather than just focusing upon short-term point solutions, then it will likely fail to deliver what the business expects. This type of failure is a common phenomenon throughout the information systems industry, not just in the realm of security architecture. Yet it is not sufficient to compile a set of business requirements, document them and then put them on the shelf, and proceed to design a security architecture driven by technical thinking alone. Being a successful security architect means thinking in business terms at all times, and setting up quantifiable success metrics that are developed in business terms around business performance parameters, not technical ones.