book

Practical Cybersecurity Architecture - Second Edition

by Diana Kelley, Ed Moyle

November 2023

Intermediate to advanced

388 pages

13h 56m

English

Packt Publishing

Read now

Unlock full access

ContributorsAbout the authorsAbout the reviewer
Who this book is forWhat this book coversTo get the most out of this bookConventions usedGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Understanding the need for cybersecurityWhat is cybersecurity architecture?Network versus application security architecture The role of the architectSecure network architecturesSecure application architecturesCase study – the value of architectureArchitecture, security standards, and frameworksArchitecture frameworksSecurity guidance and standardsSecurity architecture frameworksArchitecture roles and processesRolesProcess overviewKey tasks and milestonesSummary
TerminologyUnderstanding solution buildingEstablishing the context for designsUnderstanding goalsIdentifying business goalsDimensions of successStructures and documentsPolicies, procedures, and standardsApplying to architectural frameworksAdditional frameworksRisk management and complianceRisk management and appetiteComplianceEstablishing a guiding processUnderstanding the business’ high-level goalsUnderstanding the technology goalsDrawing implied goals from existing documentationCapturing (or defining) risk tolerancesAccounting for compliance requirementsSummary
Understanding scopeWhat’s in this chapter?Setting architectural scopeEnterprise security architectureApplication security architectureDefining scope boundariesScope – enterprise securityExisting capabilityRisk managementStrategic planningCase study – enterprise scopingScope – application securityThe development and release processComponents, services, and design patternsTeam/organizational boundariesTechnology considerationsCase study – application scopingThe process for setting scopeStep 1 – consider high-level goalsStep 2 – review contextual or other constraintsStep 3 – set the initial scopeStep 4 – validate and refine initial scopeSummary
Introduction to the architect’s toolboxPlanning toolsAnalytical toolsInformational toolsModeling and design toolsCase study – data gatheringBuilding blocks of secure designInformation security policiesOrganization of information securityHuman resources securityAsset managementAccess controlCryptographyPhysical and environmental securityOperations securityCommunications securitySystem acquisition, development, and maintenanceSupplier relationshipsInformation security incident managementInformation security aspects of business continuity managementComplianceSummary
RequirementsBlueprintsProcessWhy ADM?The visionEstablishing architectural principlesSetting the scopeGetting the desired future (target) stateCase study – shared goals, vision, and engagementCreating a programDiscovery, identification, and validationDocumenting your high-level approachCreating the roadmapArchitecture definitionAccompanying documentationSummary
Application design considerationsLife cycle modelsEnvironmentConsiderations for waterfall projectsRequirements phaseDesign phaseImplementation phaseVerification phaseMaintenance phaseCase study – waterfall developmentConsiderations for Agile projectsConception phaseInception phaseConstruction phaseRelease phaseProduction phaseRetirement phaseCase study – Agile developmentConsiderations for DevOps projectsDevelopBuildUnit testDeploy (integrate)Quality assuranceProductionValidateCase study – DevOps/DevSecOps developmentProcess for application security designSystems security engineeringArchitecture definition processArchitecture definitionDocumentationValidationModifying the SDLC and development processesSummary

Process stepsTechnical designWhat specific provider do we use to do this?Do we need additional infrastructure (VPN, access points, etc.)?What client software do users require (if any)?Creating technical implementation strategiesAssess constraints, synergies, and areas of opportunityValidating against likely threat paths and creating a skeleton solution documentValidating implementation strategiesFinalizing the documentationOperational integrationChanging context and evolutionExecution monitoringCase study – Operational integrationTelemetrySelecting strategic metricsSelecting operational metricsSummary
Overcoming obstacles in project executionScope and requirementsSupport failure and organizational issuesResource shortfallsCommunication failureTechnical and environmental issuesFuture-proofing designsEstablishing a virtuous cycleMonitoring our own environment for changesMonitoring for external changesSpecifics for machine learning projectsCase study – future-proofingSummary
Virtuous cyclesAdapting architectural processesTips and tricksHone your ability to listenCultivate empathyHave just enough processWhen in doubt, over-communicateBe ready to walk awayGotchasBe aware of (but don’t play) politicsDon’t shirk the preparationStay engaged until the endLeave ego at the doorUse a multi-disciplinary approachCase study: gotchasSummary
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Content preview from Practical Cybersecurity Architecture - Second Edition

8 Execution – Future-Proofing

In the last chapter, we went through the planning and execution of your security implementation strategies – that is, establishing what they are and laying the groundwork for putting the plans into practice. In doing so, we made a subtle but very important presupposition: namely, that things would go according to plan. Of course, in the real world, this will very seldom be the case. More likely, something will go wrong somewhere along the journey from the inception to the realization of the best-laid plans.

This chapter, then, is all about planning for the unexpected – both for unexpected events arising during the execution portion of the design implementation and situations that might arise in the future so that ...