Practical Cybersecurity Architecture

Practical Cybersecurity Architecture

by Ed Moyle, Diana Kelley
Released November 2020
Publisher(s): Packt Publishing
ISBN: 9781838989927

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Plan and design robust security architectures to secure your organization's technology landscape and the applications you develop

Key Features

  • Leverage practical use cases to successfully architect complex security structures
  • Learn risk assessment methodologies for the cloud, networks, and connected devices
  • Understand cybersecurity architecture to implement effective solutions in medium-to-large enterprises

Book Description

Cybersecurity architects work with others to develop a comprehensive understanding of the business' requirements. They work with stakeholders to plan designs that are implementable, goal-based, and in keeping with the governance strategy of the organization.

With this book, you'll explore the fundamentals of cybersecurity architecture: addressing and mitigating risks, designing secure solutions, and communicating with others about security designs. The book outlines strategies that will help you work with execution teams to make your vision a concrete reality, along with covering ways to keep designs relevant over time through ongoing monitoring, maintenance, and continuous improvement. As you progress, you'll also learn about recognized frameworks for building robust designs as well as strategies that you can adopt to create your own designs.

By the end of this book, you will have the skills you need to be able to architect solutions with robust security components for your organization, whether they are infrastructure solutions, application solutions, or others.

What you will learn

  • Explore ways to create your own architectures and analyze those from others
  • Understand strategies for creating architectures for environments and applications
  • Discover approaches to documentation using repeatable approaches and tools
  • Delve into communication techniques for designs, goals, and requirements
  • Focus on implementation strategies for designs that help reduce risk
  • Become well-versed with methods to apply architectural discipline to your organization

Who this book is for

If you are involved in the process of implementing, planning, operating, or maintaining cybersecurity in an organization, then this security book is for you. This includes security practitioners, technology governance practitioners, systems auditors, and software developers invested in keeping their organizations secure. If you’re new to cybersecurity architecture, the book takes you through the process step by step; for those who already work in the field and have some experience, the book presents strategies and techniques that will help them develop their skills further.

Table of contents

  1. Practical Cybersecurity Architecture
  2. Why subscribe?
  3. Contributors
  4. About the authors
  5. About the reviewer
  6. Packt is searching for authors like you
  7. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
    4. Download the color images
    5. Conventions used
    6. Get in touch
    7. Reviews
  8. Section 1:Security Architecture
  9. Chapter 1: What is Cybersecurity Architecture?
    1. Understanding the need for cybersecurity
    2. What is cybersecurity architecture?
      1. Network versus application security architecture
      2. The role of the architect
      3. Secure network architectures
      4. Secure application architectures
    3. Architecture, security standards, and frameworks
      1. Architecture frameworks
      2. Security guidance and standards
      3. Security architecture frameworks
    4. Architecture roles and processes
      1. Roles
      2. Process overview
      3. Key tasks and milestones
    5. Summary
  10. Chapter 2: The Core of Solution Building
    1. Terminology
    2. Understanding solution building
    3. Establishing the context for designs
    4. Understanding goals
      1. Identifying business goals
      2. Dimensions of success
    5. Structures and documents
      1. Policies, procedures, and standards
      2. Applying to architectural frameworks
    6. Risk management and compliance
      1. Risk management and appetite
      2. Compliance
    7. Establishing a guiding process
      1. Understanding the business high-level goals
      2. Understanding the technology goals
      3. Drawing implied goals from existing documentation
      4. Capturing (or defining) risk tolerances
      5. Accounting for compliance requirements
    8. Summary
  11. Section 2: Building an Architecture
  12. Chapter 3: Building an Architecture – Scope and Requirements
    1. Understanding scope
      1. What's in this chapter?
    2. Setting architectural scope
      1. Enterprise security architecture
      2. Application security architecture
      3. Defining scope boundaries
    3. Scope – enterprise security
      1. Existing capability
      2. Risk management
      3. Strategic planning
    4. Scope – application security
      1. The development and release process
      2. Components, services, and design patterns
      3. Team/organizational boundaries
      4. Technology considerations
    5. The process for setting scope
      1. Consider high-level goals
      2. Review contextual or other constraints
      3. Set the initial scope
      4. Validate and refine the initial scope
    6. Summary
  13. Chapter 4: Building an Architecture – Your Toolbox
    1. Introduction to the architect's toolbox
    2. Planning tools
      1. Analytical tools
      2. Informational tools
      3. Modeling and design tools
    3. Building blocks of secure design
      1. Information security policies
      2. Organization of information security
      3. Human resources security
      4. Asset management
      5. Access control
      6. Cryptography
      7. Physical and environmental security
      8. Operations security
      9. Communications security
      10. System acquisition, development, and maintenance
      11. Supplier relationships
      12. Information security incident management
      13. Information security aspects of business continuity management
      14. Compliance
    4. Summary
  14. Chapter 5: Building an Architecture – Developing Enterprise Blueprints
    1. Requirements
    2. Blueprints
    3. Process
      1. Why ADM?
    4. The vision
      1. Establishing architectural principles
      2. Set Scope
      3. Desired future (target) state
    5. Creating a program
      1. Discovery, identification, and validation
    6. Documenting your high-level approach
      1. Creating the roadmap
      2. Architecture definition
      3. Accompanying documentation
    7. Summary
  15. Chapter 6: Building an Architecture – Application Blueprints
    1. Application design considerations
    2. Life cycle models
      1. Environment
    3. Considerations for Waterfall projects
      1. Requirements phase
      2. Design phase
      3. Implementation phase
      4. Verification phase
      5. Maintenance phase
    4. Considerations for Agile projects
      1. Conception phase
      2. Inception phase
      3. Construction phase
      4. Release phase
      5. Production phase
      6. Retirement phase
    5. Considerations for DevOps projects
      1. Develop
      2. Build
      3. Unit test
      4. Deploy (integrate)
      5. Quality assurance
      6. Production
      7. Validate
    6. Process for application security design
      1. Systems security engineering
      2. Architecture definition process
      3. Architecture definition
      4. Documentation
      5. Validation
      6. Modifying the SDLC and development processes
    7. Summary
  16. Section 3:Execution
  17. Chapter 7: Execution – Applying Architecture Models
    1. Process steps
    2. Technical design
      1. What specific product do we buy to do this?
      2. Where do we place VPN concentrators or access points?
      3. What client software do users require?
      4. Creating technical implementation strategies
      5. Assess constraints, synergies, and areas of opportunity
      6. Validating against likely threat paths and creating a skeleton solution document
      7. Validating implementation strategies
      8. Finalizing the documentation
    3. Operational integration
      1. Changing context and evolution
      2. Execution monitoring
    4. Telemetry
      1. Selecting strategic metrics
      2. Selecting operational metrics
    5. Summary
  18. Chapter 8: Execution – Future-Proofing
    1. Overcoming obstacles in project execution
      1. Scope and requirements
      2. Support failure and organizational issues
      3. Resource shortfalls
      4. Communication failure
      5. Technical and environmental issues
    2. Future-proofing designs
      1. Establishing a 'virtuous cycle'
      2. Monitoring our own environment for changes
      3. Monitoring for external changes
    3. Summary
  19. Chapter 9: Putting It All Together
    1. Virtuous cycles
      1. Adapting architectural processes
    2. Tips and tricks
      1. Hone your ability to listen
      2. Cultivate empathy
      3. Have just enough process
      4. When in doubt, over-communicate
      5. Be ready to walk away
    3. Gotchas
      1. Be aware of (but don't play) politics
      2. Don't shirk the preparation
      3. Stay engaged until the end
      4. Use a multi-disciplinary approach
    4. Summary
  20. Other Books You May Enjoy
    1. Leave a review - let other readers know what you think

Product information

  • Title: Practical Cybersecurity Architecture
  • Author(s): Ed Moyle, Diana Kelley
  • Release date: November 2020
  • Publisher(s): Packt Publishing
  • ISBN: 9781838989927