Demonstrated understanding of security concepts and the application of best security practices during the whole system life cycle. Demonstrated understanding of regulations and compliance, security administration and business continuity assurance. Demonstrated competence in basic implementation techniques.

Why does an architect need this skill?

Security is one “universal” quality property. That is, it is present in all systems, even small, simple ones.  The architect should be aware of that, and needs to have the “security awareness”, a state that will detect security requirements in regular, common scenarios, even when no security seems to be needed. That is because security relates not only to authentication, but also on quality of delivery, availability and several other “illities”

Common tasks involved in this skill?

The architect should understand what security is about, and include security awareness from stage 0 (stating the business context). The architect must understand business needs and identify the security requirements aligned with the business strategy. The architect needs to comply with regulations, establish security models and frameworks, review correct design and coding practices, and assure security is present during operation and sunset of systems.

What is their ownership in this skill?

The architect is the closest link to the system implementation in a special security chain that starts with the business goals and strategy, the stakeholder and the security officers.

Name an example of how an architect would use this in daily activities?

For instance, an online sales company wants to expand its operations and become international. Apart from ensuring the use of the best security practices to provide confidentiality, integrity and availability, the architect must also understand the requirements in this strategy, take into account regulations on the target countries regarding information use and distribution, the regulations and compliance to industrial payment standards, the effect on availability of the increased number of clients, etc.

Describe why an architect should be involved in this skill at a corporate level

Security is not a technology only issue, it relates primarily to business. The impact of a security breach affects business in several ways, from an impact to the company image and trust, to the loss of money due to non-operation periods. Still, security is mainly enforces using technology, and security in technology is a very complex area. This is why architects should need this skill in a corporate facing analysis of security needs.

Primary push back and/or challenges for architects

Security is usually thought as an identification/authorization problem. It is also taken as a afterthought, something to be added later. To create a robust architecture, the architect needs to understand and make understandable to stakeholder, the complexity of security, risk and planning.

How would a stakeholder engage an architect for assistance utilizing this skill?

As mentioned, security is almost a universal topic, present in all systems. It should be part of every requirement/scenario/use case review. Sadly, more than often the topic is mentioned after a problem or attack has been detected.

Secure Component Skills:

This includes but is not restricted to: most know security models and methodologies, authorization models, knows security related frameworks, hacking methodologies, the C.I.A. acronym (Confidentiality, Integrity and Availability), risk evaluation concepts.

Security in Requirements

Methods and techniques to elicit security requirements evaluate them and prioritize them along the business strategy. Includes generation of negative requirements, abuse cases, risk management and threat modeling.

Security in Architecture and Design

Security analysis at architectural level, description of solution using improved architectural views, the security perspective (Woods/Rozanski), security in architectural styles. Also security design principles.

Security in Implementation

Knowledge of security issues in different languages, workarounds, common software vulnerabilities, defensive programming, security code smells, security in the software process.

Security in Acceptance

Evaluation of required acceptance level for security, acceptance testing, certification and accreditation.

Security in Deployment, Operations, and Disposal

Environment hardening, penetration testing, problem and incident management, problem detection, monitoring, information protection and destruction.

Business continuity and disaster recovery planning

As part of the Availability concern (from the C.I.A. acronym), the architect needs to know about critical business process protection, business continuity planning and execution, disaster detection, containment and recovery. These topics are covered in other capabilities, like the Availability Quality Attribute in ‘Performance, Reliability, Availability, Scalability’ and Disaster Recovery in Disaster Recovery and Backup.

Security Regulations and Compliance

Industrial, geographical and political regulations are to be known and understood.

Articles –

Blogs/Webcasts/News Sources –

• 40 Security Blogs at http://www.securityinnovationeurope.com/blog/40-information-security-blogs-you-should-be-reading

Training –

• CISM Review Courses (http://www.isaca.org/Certification/CISM-Certified-Information-Security-Manager/Prepare-for-the-Exam/Review-Courses/Pages/default.aspx)
• ISC2 courses (https://isc2.org/elearning/default.aspx)

Certifications –

• (ISC)2 CISSP
• (ISC)2 CSSLP
• IASACA CISM

Books –

• Paul Mano, Official ISC2 Guide to the CSSLP
• Adam Gordon, Official ISC2 Guide to the CISSP CBK
• Gary McGraw, Software Security: Building Security In
• Ron McFarland, INFORMATION SECURITY BASICS: FUNDAMENTAL READING FOR INFOSEC INCLUDING THE CISSP, CISM, CCNA-SECURITY CERTIFICATION EXAMS

William Martinez
R&D Manager – Avanta Technologies