Sherwood Applied Business Security Architecture (SABSA) is an Enterprise Security Architecture Framework which ensures completeness and justification for all components of your Enterprise Security Architecture and no hand-waving nor personal/professional bias towards what your security should look like.
SABSA provides the means by which we integrate different solutions and approaches to differing and complex needs, and provides a mechanism to manage such complexity. This security architecture defines a conceptual layered model which enables the provision of a holistic, strategic and architectural approach as opposed to the more typically seen application of technology and process stand-alone solutions to tactical security objectives. The security architecture is effectively “business-driven” and “business-led”, and aims to architect on both Control objectives (protecting your passwords or web servers with hardening) but also Enablement objectives (how security can help the organisation be perceived as competent and having an appropriate time to market).
SABSA ensures that different views of security are taken in consideration through its layered model, as different stakeholders need to be differently informed about what it means to them, whilst still allowing for traceability across the stack. These related and layered requirements are then mapped through the chain to ensure architectural traceability and justification for the elements of the architecture.
Strategically, SABSA is a great way to identify duplication and bias in the security mechanisms and components used, ensuring consolidation of components and operational overhead related with it.
SABSA can be used as a communication mechanism and open dialogue for discussion of options with stakeholders.
