Enterprise Security Architecture and Information Security Models

Introduction to Enterprise Security Architecture

• Domain Definition: The Enterprise Security Architecture (ESA) domain encompasses the core concepts, principles, structures, and standards required to design, monitor, and secure operating systems, hardware, networks, and applications. It includes controls designed to enforce specific levels of:

  • Availability: Ensuring systems and information are accessible and usable when needed.

  • Integrity: Protecting information from unauthorized modification.

  • Confidentiality: Protecting information from unauthorized disclosure.

• Infrastructure Components: The organizational infrastructure includes various items that must be secured:

  • Hardware and Software.

  • Operating Systems and all associated functions.

  • Applications and Utilities.

  • Network environments.

  • Security awareness and training programs.

  • Information system security supporting elements: Policies, procedures, baselines, and standards.

• Cloud Computing Infrastructure Example: Typical components include Routers, Virtual Desktops, End Users, Storage/Data, AAA Apps, Software, Platforms, Switches, and Servers.

Goals and Pillars of Information Security

• Core Security Principles (CIA Triad):

  • Confidentiality: Prevents the unauthorized disclosure of systems and information.

  • Integrity: Prevents the unauthorized modification of systems and information.

  • Availability: Prevents the disruption of service and productivity.

• The Three Pillars: People, Process, and Technology:

  • People:

    • Every individual in the business must be aware of their role in preventing and reducing cyber threats (e.g., handling sensitive data, spotting phishing emails, following Bring Your Own Device (BYOD) policies).

    • Specialized technical cybersecurity staff must possess up-to-date skills and qualifications to implement appropriate controls and technologies against the latest threats.

  • Processes:

    • Defined by how the organization’s activities, roles, and documentation are utilized to mitigate risks to information assets.

  • Technology:

    • Deployed to prevent or reduce the impact of cyber risks based on risk assessments and the determined "acceptable level of risk."

Key Definitions and Distinctions

• Enterprise: A single collective unit consisting of multiple internal networks, internal areas or domains, various internal devices and systems, applications, and a diverse user presence.

• Architecture: The highest-level concept of a system within its environment.

• Security Architecture: A high-level design created to satisfy a system’s security requirements as defined in the organization’s security policy.

• Enterprise Security Architecture: Defines the information security strategy, consisting of layers of policy, standards, and procedures and the methods by which they are linked across the enterprise.

• Infrastructure vs. Architecture:

  • Infrastructure refers to the supporting elements needed for functionality.

  • Architecture refers to the cohesive design of those elements.

The Architecture Definition Process

• The process follows a hierarchy of elaboration:

  1. Security Principles: Reflecting current business and security decisions.

  2. Security Architecture Principles: Defining the strategy and architecture principles.

  3. Detailed Security Architecture: Defined with increasing levels of elaboration.

  4. Technical Framework: Provides the specific technical criteria for implementation.

• Typical Representation: While IT security architecture is often represented technically (computer and network facilities), this technical representation should be viewed as the ‘end game’ or the final result, not the starting point.

Key Security Decision Areas in ESA

• Security Zones:

  • Recognition and definition of relationships and boundaries between the organization and business partners.

  • Provides a framework for a consistent approach to risk management and policy support.

• Information Classification:

  • Recognition and definition of levels of security sensitivity for information.

  • Definition of requirements and treatment based on that classification.

Enterprise Security Architecture Zones Based on Trust

• Untrusted Zone: General Internet.

• Semi-Trusted Zone:

  • Connection Zone.

  • Dial-Up Connectivity Zone.

  • VPN Connection Zone.

  • Wireless Connectivity Zone.

  • E-Business Hosting Zone.

  • WAN Connectivity Zone.

• Trusted Zone:

  • User LAN Zone.

  • Core Network.

  • Data Center Zone.

Objectives and Attributes of ESA

• Objectives:

  • Provides guidance for decision-makers.

  • Ensures business and security decisions are strategically aligned and consistent.

  • Provides security-related input into the design of IT technology, systems, and applications.

  • Ensures the application of security best practices.

  • Utilizes security zones to compartmentalize the environment.

• Attributes of ESA:

  • Strategic: Has a longer life than a blueprint, design specification, or configuration.

  • Technical Direction: Supports a long-term view rather than short-term technical constraints.

  • Stability: Is not invalidated by changes in technical direction.

  • Business Centered: Focuses on the acceptance and management of risk.

  • Flexibility: Allows for multiple implementations depending on requirements.

  • Foundational Qualities: Focuses on Interoperability, Integration, Ease-of-use, and Standardization.

Benefits and Management Expectations

• Benefits:

  • Consistent management of IT risk using industry best practices.

  • Reduced costs and improved flexibility through common security solutions.

  • Reference guidance for external organizations interacting with the enterprise.

• Management Expectations:

  • Mitigate risk: Managers need to know exactly what risk is present.

  • Enhance user productivity: Security should not hinder productivity.

  • Reduce Cost: Security is assumed to be "built-in."

  • Streamline Application Development/Integration: Security must not inhibit progress.

Symptoms of Lacking an Enterprise Security Approach

• Inability to support increased user access requirements efficiently while controlling costs.

  • Failure to identify exposures from modern access points like Portals and Internet-based solutions.

  • Increased consumer complaints regarding the misuse of personal/confidential data.

  • Lack of mutual understanding between IT and business units regarding regulatory and legal compliance.

  • Difficulty supporting e-commerce while maintaining legacy infrastructure.

Point Solution vs. Enterprise Solution Approach

• Point Solution Approach:

  • Lacks executive management support and visibility.

  • Focuses on one-off, non-integrated fixes for immediate problems.

  • Results in increased Total Cost of Ownership (TCO) and redundancies.

• Enterprise Solution Approach:

  • Provides strategic alignment and executive support.

  • Facilitates accountability, authority, and responsibility.

  • Provides integrated solutions with long-lasting value.

  • Reduces TCO by consolidating management.

Components of Enterprise Security Architecture

• Strategic Alignment:

  • Components: Executive Level Sponsorship (C-level), Current Profile (Threat orientation, Risk tolerance), Security Strategy ($3$-year operating model).

  • Considerations: All stakeholders must speak the "same language"; alignment between owners, custodians, and stakeholders.

• Business Enablement:

  • Components: Security Solution Diagnostic, Policy and Standards, Technical Control Architecture, Awareness and Training, Compliance and Assurance.

  • Considerations: Zone analysis for end-to-end transaction integrity; application of security plans to networks, apps, and processes.

• Process Enhancement:

  • Components: Security Criteria/Models, Core Enterprise Processes (Architecture, Engineering), Security Champions/SMEs, Communication Portals.

  • Considerations: Center of Excellence (COE) approach; incentive concepts to promote security staff as "enablers" rather than "roadblocks."

• Security Foundation:

  • Components: Security Management Plan, Business Continuity Management Plan, Infrastructure Security Plan (Physical/Network), Application Integrity Plan, Identity Management Plan, Privacy Plan.

• Security Effectiveness:

  • Components: Key Performance Indicators (KPIs), Metrics, Compliance Monitoring, Regulatory Audit Plans.

  • Considerations: Focus on objective indicators; Service Level Agreements (SLAs) for customer satisfaction; Return on Investment (ROI).

Access Control (AC) Models

• Goal: Protect data and resources from unauthorized use.

• Definitions:

  • Policy: High-level rules describing authorized access.

  • Model: Formal specification of AC enforcement.

  • Mechanism: Low-level software/hardware implementation of policies.

• Access Matrix Model:

  • Authorization state is a triple $(S, O, A)$.

  • $S$: Set of subjects.

  • $O$: Set of objects.

  • $A$: Access matrix where rows are subjects and columns are objects.

  • $A[s, o]$ describes the privileges of subject $s$ on object $o$.

• Discretionary Access Control (DAC):

  • Explicit rules establish who executes actions on resources.

  • Users can pass rights to others.

  • Regulated by administrative policy (centralized or ownership-based).

  • Weakness: DAC only constrains direct access. Information can be leaked after release. Trojan horses can exploit the privileges of the calling subject to compromise data.

• Mandatory Access Control (MAC):

  • Goal: Prevent illegitimate flow (leakage) of information.

  • Method: Attach security labels to subjects and objects.

  • Distinguishes between users and the subjects acting on their behalf.

Security Models

• Information Security Model Types:

  • Confidentiality models (e.g., Bell-LaPadula).

  • Integrity models (e.g., Biba, Clark-Wilson).

  • Static models vs. dynamic models (e.g., Chinese Wall).

• Bell-LaPadula (BLP) Confidentiality Model:

  • A state machine model for government/military use.

  • Confidentiality Only.

  • Rules:

    1. Simple Security Property: "No read-up." A subject cannot read an object of higher sensitivity.

    2. Star Property (* property): "No write-down." A subject cannot write to an object of lower sensitivity.

    3. Strong Star Property: Subject cannot read/write to objects of higher/lower sensitivity.

  • Limitations: No integrity or availability policies; assumes classification is fixed and never changes.

• Biba Integrity Model:

  • The opposite of BLP; addresses data integrity.

  • Goals of Integrity:

    1. Prevent unauthorized users from modifying data.

    2. Prevent authorized users from making improper modifications.

    3. Maintain internal and external consistency.

  • Rules:

    1. Simple Integrity Condition: "No read-down." Subject cannot read objects of lesser integrity.

    2. Integrity Star Property (* property): "No write-up." Subject cannot write to objects of higher integrity.

    3. Invocation Property: Subject cannot send messages to an object of higher integrity.

  • Strict Integrity Policy: Enforces "no write-up" and "no read-down." This limits damage by malicious objects (like Trojan horses) and prevents trusted subjects from being contaminated by less trusted objects.