My slides for the Security Conference, fall 2010 by NLUUG in the Netherlands. Subject: IT architecture and IT Security, a match made in heaven

1. <presentatie>

2. Ir. Willem J. Kossen
Informatiebeveiliging en
ICT-Architectuur,
een 'match made in heaven’

3. <Today>
• About @wkossen
• The Statement
• Some Reasoning
• Some Discussion
• Don’t hesitate to tweet…
</Today>

4. ---1---

6. @wkossen

7. http://willemkossen.nl/b
http://linkedin.com/in/willemkossen
http://twitter.com/wkossen
http://stamstruik.nl
http://insecten.org
http://gazzary.nl
…
http://wkossen.myopenid.com

8. http://www.mxi.nl

10. ---2---

11. Architecture?
• Definition
anyone?

13. • A set of design artifacts, that are relevant
for describing an object such that it can be
produced to requirements (quality) as well
as maintained over the period of its useful
life (change). The design artifact describe
the structure of components, their inter-
relationships, and the principles and
guidelines governing their design and
evolution over time.
• Source: http://www.opensecurityarchitecture.org

14. Buildings
• IT Architecture <> Building Architecture
• FAIL

15. • Diagram of stiffness of a simple square beam (A) and
universal beam (B). The universal beam flange sections are
three times further apart than the solid beam's upper and
lower halves. The second moment of inertia of the universal
beam is nine times that of the square beam of equal cross
section (universal beam web ignored for simplification)

16. VS.

19. Security
• Definition
anyone?

21. • Security betekent dat de architect
eerst moet inloggen voor hij wat
mag zeggen…

22. Some sites attempt to use firewalls to solve
their network security problems.
Unfortunately, firewalls assume that "the
bad guys" are on the outside, which is
often a very bad assumption (MIT)

23. • Proper Diskette Care and Usage
• (1) Never leave diskettes in the drive, as the
data can leak out of the disk and corrode the
inner mechanics of the drive. Diskettes should
be rolled up and stored in pencil holders.
• (9) Periodically spray diskettes with insecticide
to prevent system bugs from spreading.....
• (13) Diskettes become "hard" with age. It's
important to back up your "hard" disks before
they become too brittle to use.
• http://www.monster-island.org/tinashumor/humor/diskcare.html

24. • Security provided by IT Systems can be
defined as the IT system’s ability to being
able to protect confidentiality and integrity
of processed data, provide availability of
the system and data, accountability for
transactions processed, and assurance
that the system will continue to perform to
its design goals
• Source: http://www.opensecurityarchitecture.org

25. NEN 7510
ISO/IEC 17799

26. Defining
• Tends to be hard
• No-one agrees
• Multi-interpretable
• Inconsistent
• Vague
• Non conclusive
• Impractical
• …

27. What can we do?
• Make lists
• Talk by example
• Roll-Your-Own !!!
• Use what works
• Just choose
• …

28. So much in common
• About Real life
– Physical, information, behaviour, procedures, tech, etc
• Business critical
• Descriptive and normative
• Quality oriented
• Needs awareness
• Tend to make things a bit harder
and costly 
• Take thought, balance
and nuance
• …

29. Architecture is:

30. Relation

31. What I Do…
Samen Veilig
Open
Architectuur

32. IT Security Architecture
• The design artifacts that describe how the
security controls (= security
countermeasures) are positioned, and
how they relate to the overall IT
Architecture. These controls serve the
purpose to maintain the system’s quality
attributes, among them confidentiality,
integrity, availability, accountability and
assurance.
• Source: http://www.opensecurityarchitecture.org

33. ---3---

34. Match Made in Heaven?

35. • Architecture focuses on coherence,
principles, standards and buildingblocks,
• Security applies aspects of those to real life

36. • Architecture and Security are
interdependent. The one without the other
doesn’t make sense

37. • If separated, security remains limited to
Ad-Hoc conjuring up measures aimed at
risk reduction and generally towards
technocracy. That tends to not help the
organisation.

38. • Applying IT Security should be aimed at
providing the best experience for the user
or client with the least amount of
obstruction
• That way organisational goals (including
change) can be met.

39. • Architectural thinking supports that goal

40. This isn’t automatic.
Awareness is needed:
Architectural awareness is a precursor for
security-awareness.

41. • Architecture is… (remember?)
• Trends, standaarden, bestpractices,
• Goals, strategy, vision, policy
• Functional and operation requirements,
processes
• Risks and other constraints (financial)
• Development, design, build, exploitation
• Security is present in all of the above…

42. • Again, the connection is architecture
• security is one of the views on
architecture.
• Looking at security this way,
– we improve desicionmaking,
– we avoid risk,
– we prevent tunnelvision,
– everybody profits from the
IT assets

43. • Mensenwerk

44. • If tijd>10min soundbite()

46. ---4---

47. Let’s Talk…
• Nabranders: w.kossen@gmail.com

48. </presentatie>