Enterprise Cyber Security Reference Architecture (by Boris Taratine)

 Enterprise Cyber Security Reference Arc ...Operation and supportCyber strategyBusiness Strategy Alignment - The BoardVision, Goals, ObjectivesCurrent stateFuture business development scenariosGoverning principlesFunding modelRisk tolerance statementRoadmapGovernanceOwnership and accountabilityCollaborationIntelligence analysisReconcile conflicting needsCertification and accreditationAgile cybersecurity investmentCyber strategy alignmentCyber Target Operating ModelCurrent and future stateTransition planningProcesses definitionCyber control frameworkLink KPI/KRI to business KIRoles and responsibilitiesBAU ownersCapability and Maturity modelsArchitecture and GovernanceData governance and Information risk man ...Critical information assets - CIACritical business processes - CBPData governance frameworkDLP rules and policiesRecords managementOwnership & StewardshipPrivacy impact assessmentRetention rules and policiesIntellectual property and Digital rightsData qualityNon-Critical information assetsNon-Critical business processesRisk assessmentMetadata control and Data segregationLabelling and handlingKnowledge managementData devaluation and Secure data disposa ...Data classificationCIA & CBP MappingAccountabilityAudit and compliancePolicy Standards LifecycleRegulations and LegislationsVulnerability managementCritical data assurancePrioritisationAudit and compliance monitoringService ComplianceAction trackingGood vs Best practicesCompliance metrics translation to cyber  ...Risk ManagementCyber risk assessmentRisk categorisationScenario analysisAssurance review and oversightAssurance findingsAudit findingsThreat and vulnerabilityAction trackingCyber risk metrics (KRI)Cyber risk management frameworkControl assessmentMaterial breach reportingMaterial event reportingsk and regulatory reporting (ext. and in ...Cyber resilience vs BenchmarkingRisk metrics translation to cyber securi ...Communication and PRThe BoardGovernmentColleaguesSuppliersStandardised press releasesRegulatorsCustomersPartnersBusiness LiaisonSocial MediaCyber awarenessService desk and Call centreColleagues cyber supportCustomers cyber supportCyber awarenessEducation and AwarenessNon-ExecutivesExecutives3rd parties cyber readinessPhysical securityStakeholders managementRole based trainingColleaguesCustomer-facing staffCall centreService deskSocial engineeringCertification and AccreditationHigh risk colleaguesCyber aware cultureService deliveryService catalogRecovery plansPolicies and standardsKPI/KRIBusiness focussed SLAHuman ResourcesBackground screeningRetain best skills in-houseEngagementSegregation of dutiesAwarenessSkills developmentVettingJoiners Movers Leavers - JMLCode of ConductLegalSupport prosecution of offendersContracts and Exit strategyE-DiscoveryIncident response legal preparation3rd parties ManagementCertification and AccreditationContracts and Exit strategyCollaborationContacts and security schedulesAuditInformation sharingMonitoringTesting and readinessCentralised repositoryReporting servicesDashboardBusiness intelligenceManagement intelligenceData miningPoliciesFinanceKPI/KRIReporting toolsRegular cyber drillsDesk Top exercisesKRI/KPIKnowledge managementOperating modelRoles and responsibilitiesWorkflow processRepositoryCyber intelligence libraryIndicators of compromiseThreats, vulnerabilities and solutionsPlaybooksCyber incidents historic trendsTrends analysisGuidance and FAQsBest practicesIntelligence analysis reportsBusiness impact analysis reportsForensics historyCyber standards and patternsTools and contentCyber and Infosec knowledge repositoryControl policyTaxonomy asset classificationControl policyWorkflow and categorizationDocument management and collaboration pl ...Robustness (preventative measures)Architecture and DesignRisk basedPrinciple drivenStandardisedAgileInformation privacyData leakage protectionClient DLPChannel DLPData protection labelsData sharing labelsPrivacy impact assessmentsAnti-malwareWeb scanEmail scanWhite listingSandboxingSignature file reductionAdvanced malware protectionBehavioural analyticsChannel separationIsolation and segregationData accessIn-transit protectionAt-rest protectionIn-use protectionCompartmentalisationSecure APIOpportunistic encryptionCrypto servicesPKIPGPKey managementCertificates managementIdentity and Access ManagementIdentity lifecycle managementID and Entitlement provisioningPhysical access integrationRole managementSegregation of dutiesAccess restrictionAccess managementSystem authenticationStrong authenticationWeb access managementToxic identity combinationsPrivileged identity managementOn demand privilege escalationPrivileged accountsPrivileged sessionsPrivileged passwordsBreak-glass processMonitoring and recertificationApplications and platformsApplication specific access controlsPlatform specific access controlsToxic identity combinationsInteroperabilityIdentity services and federationIdentity federationSingle sign onVettingIdentification and verificationAuthentication, authorization, and audit ...Identity stores synchronisation servicesInfrastructure securityInternal and external networkSegregation and compartmentalisationReduce statefulnessDDoS defenceAccess controlShared servicesIoT and sensors securityTime synchronisationVirtualisationAssuranceRemote and wireless accessIntrusion detection and preventionProtocols configuration hardeningSecure information exchangeBCPs and standardsCore business networkOrganisation dependentCritical national infrastructureOrganisation dependentApplication SecurityApplication lifecycleSecure codingMature SDLCTestingRemediationDevelopers training including 3rd partie ...Application protectionCode signing and obfuscationSecure APIApplication DDoS defencesRuntime self protectionApplication gatewaysCustomer-end and mobile applicationsMalware and anomaly detectionPhishing, Smishing, Vishing protectionRogue elements takedownSecure developmentSecure distributionSecure enrollmentTemper detectionAuthenticationAppstore monitoringCode signing and obfuscationIntelligenceConfiguration management and hygieneDataIntegrity validationControlled distributionRetainmentApplicationsMaintenanceSource code protectionVersion controlCurrencyInfrastructure"Under attack" capacity planning Assets discoveryCurrencyEnd point virtualisation and isolationGeneralHardeningPatchingDecommissionMedia lockdownTracked inventoryCertification and accreditation(Pen) testingAuditResilience (early detection and fast rec ...Security and fraud monitoringSecurity Intelligence Centre DashboardSecurity infrastructure monitoringIoT sensorsHoney potsEvent miningSecurity technologies logsPrivileged credentials and AAA monitorin ...NetflowSmart card usageEvent correlationApplication security eventsData integrity monitoringCCTVData analyticsDB security eventsC&C monitoringDeep packet inspectionVoIP and telephonyBehaviour patternsWeb activity security eventsDNS monitoringDHCP monitoringDarknet monitoringACL monitoringEnd point security eventsE-mail journalingCompliance monitoringExternal feedsVulnerabilities monitoringReporting and communicationExternal services security eventsManaged security servicesThreat modellingKPI/KRILog collection, events optimisation, and ...Cyber incident and crisis managementQuick decision makingReportingBreakglass proceduresInvestigationsCommunicationRecovery protocolsForensic skills and analysisUp to date diagramsResponse scenariosScenarios rehearsalAvailability managementOperational securityCollateral damage controlRetaliation scenariosCritical int and ext escalation points o ...3rd parties engagementStaff empowerment and delegationsRapid and Agile responseFeedback to event readinessKPI/KRIContainment strategy (Kill Chain . Diamo ...Cyber event readinessVirtual Red Team exerciseRed team vs Blue teamIntel driven pen testDeception & Denial planningSocial mediaIndustry contactsTargeted attack simulationPlaybooks and use casesDisruption planningNew technologies and innovationRegular cyber drillsThreat modellingVulnerability managementCapacity planningArchives and backupsAttacks and APTs patterns studyCritical int and ext escalation points o ...Continuity and contingency planningFeedback to incident and crisis manageme ...KPI/KRITraining, awareness, and talent retentio ...Anomaly detectionBusiness intelligenceReputation and Threat analysisBrand monitoringFraud detectionBusiness rules baselineMalwareTransaction monitoringBotnet monitoring and protectionEmail queuingBlack market monitoringSocial media monitoringActionable reportingCCTVIVRTrusted intelligence feedsIoC correlationSmart card usageC&C monitoringRoot Kit detectionData access intelligenceBehaviour monitoringDNS protection and monitoringForensic analysisData SciencePath of least resistanceBack-doorsReal time responseKPI/KRIAnalytics platformActive Cyber DefenseIntelligence, collaboration and informat ...Operational intelligenceTactical intelligenceStrategic intelligenceUnderstanding of the adversaryAnalysisAnalyticsReportingDisseminationPlanning / ActionFeedback loopGeo-political analysisCounter threat managementInformation sharing protocolsExternal partiesDarknet monitoringSocial media monitoringIoC correlationTrusted distribution channelsIntelligence grading scoreTrusted information exchangeCommunity of practiceModeling and simulationKPI/KRIIntelligence sharing platformDeception and denialDiversionResource depletionUncertaintyIntelligenceProactive measuresCounter intelligenceCognitive technologies and artificial in ...Environmental variables risk modellingAnomaly detectionIntelligence supportReal time decision makingInnovationR&DPipeline of new ideasNew combat methodsRapid evaluation , implementation, and i ...Fast responseInternal StakeholdersThe BoardCEO and Senior Leadership TeamCore Business UnitsRiskInternal AuditLegalCommunications and Public RelationsHuman ResourcesProcurement and SourcingITExternal PartiesOrganisation's Value chainCustomersOnlineMobileCall CentreBrick and MortarShareholdersIndividualsCorporate investorsGovernmentPartners To-BeTelecommunicationsMobile carriersISPESPDNS RegistrarsVendorsSecurity vendorsOS vendorsHardware vendorsSoftware vendorsService providersExternal consultanciesThink TanksAcademiaIndustry groupsSecurity forumsNGOInformation exchange boardsStandardisation bodiesMembers of CNIFinanceEnergyDefenceUtilitiesAirspaceGovernmentLegislatorsRegulatorsIntelligenceLaw enforcement(Inter)National CERTsMediaPressTVRadioSocial mediaEmergingCloud providersStandardisation initiativesTrusted distribution and communication c ...Cyber related ecosystem managementTrusted information exchange and communi ...Environmental  variables GlobalWorld economic developmentGlobal technological risksSecurity of cyberspacePoliticalGeo-political trendsGlobalNationalRegionalLocalGovernmentsActivistsTerrorismEconomicFinancial industry stabilityInvestmentsGDP trendsConsumer confidenceSocial Availability of skillsEducationCuture changeGender equalityGeneration YEthics and socal trendsTechnicalInternet of ThingsEmerging vendorsBYOD technologiesEmerging technologiesFading and legacy technologiesBig DataOmni presenceOpen APIInnovation trendsCompetitiveAlumnae interactionMarket driversNation States interestsIndustry trendsEco-system awareness and influenceSupply chain cyber readinessTrends analysisSimplificationGovernanceTarget Operating ModelLean processesLink KPI/KRI to business KIComplianceGood vs Best practicePrinciple vs Compliance drivenRisk basedCultureSimplified hierarchyInclusive dialogueData enrichment and EthicsEngagementAuthorityEmpowermentWorkforce centric securityArchitectureNormalisation of artefactsPrinciple basedReuseService orientedDesignIterationStandardisationImplementationAutomationDecommissionOperationsProcesses and proceduresAutomationNoise reductionOptimisationVirtual vulnerability patchingDecommissionStaff empowermentCrisis communicationCoordinationInfrastructureLegacy managementApplicationsOpen standardsStandardisationCode sharingCross-platform developmentServicesAutomationDataElasticFusion
hide
Enterprise Cyber Security Reference Architecture
hide
Operation and support
hide
Robustness (preventative measures)
hide
Resilience (early detection and fast recovery)