Reference Architecture Version 2.

0
Guiding Principles
q Define protections that enable trust in the cloud.
q Develop cross-platform capabilities and patterns for proprietary and open-source providers.
q Will facilitate trusted and efficient access, administration and resiliency to the customer/consumer. Business Operation Information Technology Presentation Services Security and Risk
Presentation Platform
Support Services Operation & Support Management
q Provide direction to secure information that is protected by regulations.
q The Architecture must facilitate proper and efficient identification, authentication, authorization,
administration and auditability. Presentation Modality End-Points
q Centralize security policy, maintenance operation and oversight functions.
q Access to information must be secure yet still easy to obtain.
(BOSS) (ITOS) Consumer Service Platform Enterprise Service Platform Mobile Devices
Mobile Device Management Company
Desktops
Speech Recognition
(IVR) Governance Risk & InfoSec
q Delegate or Federate access control where appropriate.
B2E B2M
owned
Third-Party Public Kiosk Compliance Management
Social Portable Devices
q Must be easy to adopt and consume, supporting the design of security patterns Colaboration Compliance Policy Management
q The Architecture must be elastic, flexible and resilient supporting multi-tenant, multi-landlord platforms Compliance IT Operation Media B2B B2C
Medical Devices Smart Appliances Handwriting Management Exceptions Self Assessment
Capability
Mapping
Fixed Devices (ICR) Vendor Audit IT Risk Risk Portfolio Risk
q The architecture must address and support multiple levels of protection, including network, operating Search E-Mail e-Readers P2P
Audit Planning Secure Sandbox Management Management Management Management Dashboard
system, and application security needs. Contact/Authority DRP IT Governance
Independent Third-Party Internal Maintenance Technical Awareness and Training Residual Risk Management
High Level Use Cases Audits Audits Audits Plan Test Architectrure Standards and
Information System Regulatory Management Management Governance Guidelines
Mapping
Intellectual Property Protection
Privilege Management Infrastructure

Data Governance
Resource
Management
PMO
Program
Portfolio
Management Application Services Identity Management
Domain Unique
Identifier
Federated IDM
Authentication Services
SAML
Token
Risk Based
Auth
Multifactor
Mgmnt
Segregation Maturity
Data Ownership /
Stewardship
Data
Classification
Handling / Labeling /
Security Policy of Duties Project
Mgmnt
Model Programming Interfaces Security Knowledge Lifecycle Integration Middleware Identity
Provisioning
Attribute
Provisioning
OTP
Smart
Card
Password
Management
Secure Disposal of Rules for Information Contractors Roadmap Biometrics Network
Clear Desk Policy
Data Leakage Prevention Remediation Authorization Services Authentication
Strategy Alignment Input Single Sign On
Rules for Entitlement Review Middleware
SaaS, Validation Security
Data Retention Attack Code Security Application Policy WS-Security Authentication
PaaS, IaaS Design Policy Definition
Patterns Samples Framwrok - ACEGI Enforcement
Patterns Identity Verification OTB AutN
Policy Principal Data
Operational Risk Human Resources Service Delivery Mangement Management
Connectivity & Delivery Resource Data Privilege Usage Management
Management Security Development Process Management
XACML
Keystroke/Session Password
Role Logging Vaulting
Operational Risk Committee Service Level Information Technology Obligation
Self-Service Software Quality Assurance Management Privilege Usage Resource
Crisis Business Management Resiliency Application Stress and Out of the Box (OTB) AutZ
Gateway Protection
Security Hypervisor Governance and Compliance
Management Impact Analysis Employee Employment Vulnerability Volume
Code Review
Key Risk Indicators Termination
Background
Agreements
Job
Objectives Internal SLAs
Availability Resiliency
Scanning Testing
Abstraction
Business Continuity Screening Descriptions
OLAs External SLAs Management Analysis
Threat and Vulnerability Management
Planning Testing Roles and Employee Vendor Management
Responsibilities Awareness Capacity Planning Compliance Testing Vulnerability Management
Risk Management Framework Service Dashboard

Information Services
Employee Code of Conduct Databases Servers Network Application Infrastructure DB
Business Technical
Assessment Assessment

Independent Risk Management Asset Management Application Performance Penetration Testing Threat Management
Service Operational Monitoring Service Delivery Reporting Services ITOS Problem
Management
Incident
Management
BOSS Internal External Source Code Scanning Risk Taxonomy
PMO Strategy Roadmap
Security Monitoring Services Costing Bugdeting Service
Catalog
SLAs OLAs Dashboard Data Mining Reporting Tools Business Intelligence Risk
Assessments
Data Process

SIEM Event Database Application Honey End-Point Charge

Back
Investment
Budgeting
CMDB
Knowledge
Management
Classification Ownership
Infrastructure Protection Services
Platform Mining Monitoring Monitoring Pot Monitoring
Contracts
Recovery
Plans Data Governance Security Monitoring HR Data
Server
Behavioral Malware Prevention
End-Point
Event Cloud E-Mail Market Threat Counter Non- Service Change Audit Business Anti-Virus, Anti-Spam, Host
Findings
(Employees & White Sensitive File HIPS /HIDS
Correlation Monitoring Journaling Intelligence Threat Risk Production Management Management Contractors)
Strategy Anti-Malware Firewall
Listing Protection
Assessments Data Session Authorization Authentication Application Network Computer
SOC Portal Management Events Events Events Events Events
Anti- HIPS / Host Behavioral
Media Hardware Based
Service Support
Events Virus HIDS Firewall Malware
Lockdown Trusted Assets
Managed Security Knowledge Branding Information Data Prevention
Services Base Protection
Anti-Phishing
Service Support Service
Leakage
Metadata
Segregation
User Directory Services Network
Behavioral Malware Prevention Inventory Control
Content Forensic Tools
HIPS NIPS Filtering
User Behavior & Configuration Events White Listing
Real-time internetwork defense (SCAP) Events Content
Profile Patterns Rules Firewall DPI
Transformation Services Filtering
(Metadata)
Risk Management Active DBMS NIPS / Application
Configuration Management Knowledge Database Directory
LDAP X.500
Repositories NIDS
Wireless
Protection XML Applicance Application Firewall Real
Privilege Repositories Repositories
Repository Events Services Meta Link Layer Network Security Time
Software Usage Events
Legal Services Internal Investigations Capacity Planning
Management
Physical Inventory Configuration
Management
GRC RA BIA Directory Black Listing Filtering Secure Messaging Secure Collaboration Filtering

Forensic e-Mail Virtual Services

Contracts E-Discovery Automated Asset Configuration Database Registry Location Federated
Analysis Journaling (CMDB) Change ACLs CRLs Compliance NIPS DLP eDiscovery Directory
Discovery Management DR & BC Services Services Services
Data Protection
VRA TVM Monitoring Events EVents
Incident Response Legal Logs Events Services
Plans
Preparation
Incident Management Problem Management Data lifecycle management
Automated Event Root Cause Meta Data Data
Security Incident Data Masking Data Tagging
Response Ticketing Classifiation Analysis Control De-Identification

Self-Service Ticketing
Trend
Analysis
Problem
Resolution Internal Infrastructure
Infrastructure Services Virtual Infrastructure
eSignature
(Unstructured data)
Life cycle
management
Data Obscuring Data Seeding

Cross Cloud Security Incident

Orphan Incident Management
Response
Facility Security Patch Servers Desktop “Client” Virtualization Storage Virtualization
<<insert Jairo’s content>
Data Loss Prevention Intellectual Property
Block-Based Virtualization Protection
Knowledge Management Controlled Physical Asset Management Secure Build
Image Management Local Session-
Remote
VM-Based Host-Based
Storage
Network-Based
Data Discovery
Intellectual Digital Rights
Based (VDI) LDM LVM Appliance
Network End-Point Server
Compliance Monitoring Device-
Best Trend Security Job Security
Access Handling LUN Based Switched
(Data in Transit) (Data in Use) (Data at Rest) Property Management
Electronic Service Discovery
Benchmarking Barriers
practices Analysis Aids FAQ Surveillance Data
Security Patrols
Physical
Authentication Software
Hardware
Application Virtualization Virtual Cryptographic Services
Equipment End Point Client
Application
Server
Application
Workspaces File-Based Virtualization Key Management PKI
Signature
Services
Data-in-use
Encryption (Memory)
Change Management Release Environmental Risk Management Streaming Streaming Vertical Isolation
Symmetric Asymmetric
Change Management Physical Security
Equipment Power Maintenance Keys Keys Data-in-Transit
Encryption
Data-at-Rest Encryption
(DB, File, SAN, Desktop,

Domain
Location Redundancy
Service Approval Mobile)
Review Server Virtualization Network Database (Transitory, Fixed)

SABSA Provisioning Workflow

Board
Scheduling
Virtual Machines (Hosted Based) Virtualizaton
Network Address
Virtualization

Testing Version
Container Storage Availability
Space

ITIL v3
Planned Changes Control Network Full Paravirtualization Hardware-Assisted
Virtualization
IPv4 IPv6 Mobile Device
Emergency Build Virtualization
Policies and Standards
Process or
Project
Changes
Operational
Chages
Changes Source Code
Management
Services Services Services OS TPM Virtual External Internal Operational Security Baselines Job Aid Guidelines Role Based Awareness
Solution
Data
TOGAF Network
Segmentation
Authoritative
Time Source
VIrtualization Virtualization Memory
(VLAN) (VNIC)
Smartcard
Virtualization
Information Security
Policies
Technical Security
Standards
Data/Asset Classification
Best Practices &
Regulatory correlation

JERICHO

Co-Chairs: Jairo Orea, Yaron Levi, Dan Logan.

Team: Richard Austin, Frank Simorjay, Yaron Levi, Jon-Michael Brook,
Jarrod Stenberg, Ken Trant, Earle Humphreys, Vern Williams
Date: 02/25/2013