Open Enterprise Security Architecture O-ESA (eBook)

Preface 10
Trademarks 13
Acknowledgements 14
Referenced documents 15
Chapter 1 Executive overview 18
Chapter 2 Introduction 22
2.1 General description of an enterprise security program 22
2.2 Enterprise security program framework 25
2.3 Enterprise security architecture 27
2.3.1 The house design model 28
2.3.2 The enterprise security system design model 29
2.3.3 Community standards versus corporate standards 29
2.3.4 Building codes and engineering practices versus governance 30
2.3.5 House architecture versus security technology architecture 30
2.3.6 Bill of materials versus security services 31
2.3.7 Maintenance versus operations 32
2.3.8 The remodeling 33
Chapter 3 Security governance 36
3.1 Governance components and processes 36
3.2 Governance process overview 37
3.3 Governance process roles 38
3.4 Governance model policy framework 39
3.5 Governance principles 41
3.5.1 Security by design 42
3.5.2 Managed risk 43
3.5.3 Usability and manageability 43
3.5.4 Defense in depth 43
3.5.5 Simplicity 44
3.5.6 Resilience 44
3.5.7 Integrity 45
3.5.8 Enforced policy 45
3.5.9 Design for malice 45
3.5.10 Mobility 47
3.6 Policies 48
3.6.1 Policy development 49
3.6.2 Policy template – ISO/IEC 27002 50
3.6.3 Security policy language – XACML 50
3.7 Standards, guidelines, and procedures 51
3.8 Enforcement 54
3.9 Ongoing assessment 54
3.10 Governance example 55
3.10.1 Authentication policy example 56
3.10.2 Password quality enforcement standard example 58
3.10.3 Example comments 58
Chapter 4 Security technology architecture 60
4.1 Components and processes 60
4.2 Conceptual framework for policy-driven security 62
4.3 Conceptual architecture for policy-driven security 63
4.3.1 PDP/PEP detail 66
4.4 Identity management architecture 68
4.4.1 Identity management conceptual architecture 69
4.4.2 Identity management logical architecture 70
4.4.3 Identity management security services template 72
4.4.4 Identity management physical architecture 73
4.5 Border protection architecture 77
4.5.1 Border protection conceptual architecture 78
4.5.2 Border protection logical architecture 79
4.5.3 Border protection security services template 81
4.6 Other security services template 83
4.6.1 Access management services 83
4.6.2 Configuration management services 83
4.6.3 Access control services 84
4.6.4 Authentication services 84
4.6.5 Authorization services 85
4.6.6 Detection services 85
4.6.7 Virtualization 86
4.6.8 Content control services 87
4.6.9 Auditing services 88
4.6.10 Cryptographic services 90
4.7 Design and development 91
4.7.1 Design principles 92
4.7.2 Design requirements 92
4.7.3 Design best practices 93
4.7.4 Re-usable tools, libraries, and templates 98
4.7.5 Coding best practices 99
4.7.6 Testing best practices 101
Chapter 5 Security operations 104
5.1 Asset management 106
5.2 Security event management 107
5.3 Security administration 107
5.4 Security compliance 108
5.5 Vulnerability management 109
5.5.1 Reactive process for responding to vulnerability notifications 109
5.5.2 Proactive process for vulnerability identification and response 110
5.6 Event management 110
5.7 Incident management 111
5.8 Testing security architecture 112
5.9 Security metrics 113
5.9.1 Operational and business-aligned metrics 113
5.9.2 Objectives 114
5.9.3 What is a security metric? 115
5.9.4 Types of metrics 116
5.9.5 Applying security metrics 117
5.9.6 Types of metrics 118
5.9.7 Security metrics process 122
Chapter 6 Toward policy-driven securityarchitecture 124
6.1 Policy layers and relationships 124
6.2 Policy automation vision 126
6.3 Policy automation model 128
6.3.1 Policy automation model – HIPAA example 130
6.4 Policy automation roadmap 132
Chapter 7 Conclusions and recommendations 140
7.1 Conclusions 140
7.2 Recommendations 140
7.2.1 Recommendations to user organizations 141
7.2.1 Recommendations to vendors and standards organizations 142
Appendix AGlossary of resources 144
A.1 Security governance resources and tools 144
A.2 NIST references for O-ESA implementation 146
Appendix BSecurity Architecture Checklist 148
Glossary 150
Index 156