Building Your Own Security Architecture Chapter 06: Enterprise Security Basics

4 min readJan 9, 2022

This chapter first briefly introduces the characteristics of security and threat, and then introduces security governance. Including governance scope, design principles, technical scope, compliance scope, management scope, operation scope and other related fields. Increase security for enterprise architecture through security governance, so as to build a safe, reliable, high-performance architecture system that meets cost control.

Definition

Provide security features for the enterprise architecture in various ways, and ensure the normal process through various mechanisms.

Characteristics

• Confidentiality: ensure the confidentiality of data during transmission and storage, and avoid the intentional or unintentional disclosure of data by unauthorized users.
• Integrity: ensure the correctness and consistency of data throughout the life cycle of transmission or storage.
• Availability: ensure that when users need to operate through the information system, data and services must remain available and meet their needs.
In addition to the CIA, there is 3A, authentication — identifying the identity of information users and recording access and use information; Authorization — grant appropriate authority to the entity according to the actual needs, generally using the minimum authority; Accounting — records the interaction data between the user and the system.

Threat classification

deception
• Tampering
• deny
• Information exposure
• Denial of service
• Upgrade permissions

Security Governance

Ensure that the enterprise architecture has security characteristics in different fields through technology, operation and management.

Scope

Compliance
• Data protection
• Infrastructure
• Identity access management (IAM)
• Application and service

Security Design Principle

Adapt to business objectives
• Designed for attackers
• Minimum tolerance
• Minimize attack surface
• Strong identity authentication and authority management
• Elastic design
• Shift to left
• Defense in depth
• Security by default
• Security by origin
• Make the system easy to use and automated
• Balanced investment

Compliance Scope

The legal department connects with the relevant administrative authorities and transfers them to the corresponding compliance department. Then, according to the administrative regulations, it judges whether corresponding adjustments need to be made to meet the compliance needs. For example, it is to purchase the security products of Party B’s qualified manufacturers, or use the specified encryption algorithm, etc. In terms of classification, it can generally be divided into regional and industrial:
1. Regional compliance
• International compliance
• Localized compliance
• Regional compliance
2. Industrial compliance
The industry compliance standards faced by different industries such as finance, medical treatment, insurance and automobile are also different.

Technical scope

Technology is the first productive force to solve problems
• Intrusion detection and protection: for example, intrusion detection, file integrity protection, threat intelligence, situation awareness, etc., as well as traffic cleaning (including layer 4 and layer 7 Traffic cleaning);
• Centralized log collection: for example, Splunk, elk, etc;
• Identity and access management: for example, ad, sso, MFA, Fido, etc;
• Continuous scanning and monitoring: for example, continuous scanning and monitoring of files, networks, hosts, storage, applications, codes and other assets;
• Root of trust: for example, root key, random number generator, hardware encryption module, golden cup system;
• Public key infrastructure
• Data leak protection: for example, for mail, traffic and documents;
• Security SDK: for example, encryption kit, filter, etc;
• Runtime protection: for example, container level and application level;
• Exploratory application of innovative technologies: for example, Web3 0. AI, blockchain, innovation sandbox, etc;

Operational scope

Continuous maintenance and optimization of safety objectives to be achieved
To deliver security capabilities and find new problems during continuous operation, the following attempts to introduce some operation contents from a non-technical perspective.

Life cycle management
It includes the application, creation, distribution, update, rotation, revocation and deletion of entities
• certificate
• secret key
• data
• loophole
• patch
• account
• jurisdiction
• licence
• Sensitive letters (representing sensitive information contained in the paper media)
On duty
7x24 SOP compliance monitoring and response
• monitor
• testing
• give an alarm
• Emergency response
Drill
Be familiar with the handling process in case of emergency
• Offensive and defensive confrontation
• Disaster drill
Daily
Daily work automation
The following is a brief list of some work contents according to whether it can be automatic or self-service:
• Deployment of similar products
• Host / application / network scanning, etc
• Rule extraction and data detection
• Self service
• train
o consulting service
o technical support
o System management and maintenance
o Prepare some systems, strategies and SOPs

Management scope

Resources need to be reasonably arranged
• Policy management
• risk management
• Ecological operation
• Project management
• cost control
• Document management
• Asset management
• Process management

Security Framework

SABSA
O-ESA
MLPS
NIST CyberSecurity Framework

Best Practice

We need to refer to AWS and azure.

ALL CHAPTERS:

This translation was based on 《安全架构要参：构建企业适用的安全架构》，and if you can read Chinese, please visit https://securityarchitecture.pro/