SABSA Asset Architecture and Management

Asset Architecture & Asset Management

• Asset Architecture consists of three layers: Logical, Physical, and Component
• The SABSA Matrix is a design phase that has three layers: Logical, Physical, and Component
• Logical Assets include Information Assets and Logical Asset Management, which involves Inventory of Information Assets, Information Model of the Business, and Knowledge Management
• Physical Assets include Data Assets and Physical Asset Management, which involves Data Dictionary & Data Storage Devices Inventory, Change Management, and Platform & Data Storage Management
• Component Assets include Products and Tools, including Data Repositories and Processors, and Component Management, which involves Product & Component Standards Management

Competency Objectives for Section 12

• Describe the characteristics and deliverables of the SABSA Architecture Design Phase layers
• Explain the constructs and characteristics of assets at logical, physical, and component layers
• Identify the role of SABSA techniques for security in Release & Knowledge Management
• List and define possible start-up approaches to SABSA Enterprise Security Architecture

Constructs & Characteristics of Assets

• Data Assets are raw facts, figures, and events collected by observation and recording, and stored in a specific location
• Information Assets are transformed data that is qualitative, and have context and meaning through organization and presentation
• Asset Value in SABSA is achieved if it has certain properties such as Accuracy, Completeness, Timeliness, Availability, and Relevance

Relationship With Conceptual Assets

• Business Drivers for Security are derived from the Conceptual Attributes
• The purpose of information is to contribute to business knowledge for decision-making
• Attributes in the Conceptual Layer include Accuracy, Completeness, Timeliness, and Availability

Risk & Policy Management Architecture

• Policy Management Architecture includes Policy Publication & Compliance Management, Risk Management Practices, and Risk Data Management
• Risk Management Practices include Risk Analysis Tools, Risk Registers, Risk Monitoring & Reporting, and Risk Metadata Management
• Risk Data Management includes Risk Management Components & Standards, and Risk Procedure Management

Competency Objectives for Section 13

• List the requirements for architected controls in Risk & Policy Management Architecture
• Explain the association of architected controls with SABSA Contextual & Conceptual layers
• Describe the structure and objectives of the SABSA Assurance Framework
• Explain the application of the SABSA Assurance Framework and its relationship with Risk Level### Risk and Policy Management Architecture
• Business risks and opportunities are associated with logical domains, physical environment, and infrastructure domains
• Risk level is linked to policy level and control level, which includes activity controls
• Security services are managed at each layer, including security mechanisms and infrastructure and environment management
• Risks and opportunities are managed by standards for tools and products, and security components and configurations

Architectural Control Distribution Case Study

• Business context involves interactions between government departments
• Business drivers for security include information confidentiality and integrity in storage and transit
• Business attributes include confidentiality, integrity, authenticity, and assurance
• Architecture controls and enablers include logical services, physical mechanisms, and component activities
• Logical services include credentials issuance, session authentication, and message origin authentication
• Physical mechanisms include SSL, VPNs, disk encryption, and file hashing
• Component activities include user credential management, certificate management, and key management

ORM Architecture Inheritance and Re-use

• SABSA risk assessment establishes enterprise attributes, control and enablement objectives, and risk register
• The risk assessment creates a traceable layer-map from business requirements to controls
• The layer-map becomes the current-state SABSA enterprise security architecture
• Subsequent SABSA risk assessments can re-use the existing architecture, inheriting controls and enablers from the current-state architecture
• New attributes and performance thresholds required by subsequent projects can be enhanced and added to the existing architecture

This quiz covers the design phase of asset architecture and management, including scope and temporal factors. It is based on the SABSA Institute's framework for security architecture and risk management.