Practical Cybersecurity Architecture

Practical Cybersecurity Architecture

Cybersecurity is quickly becoming a “make or break” topic area for most businesses. We all can cite numerous examples of headlines describing security issues, notifications from companies or online services that we use, and (in some cases) even breaches that have impacted organizations that we’ve worked for. We all know the stories of vulnerable software, scammed users, accidental misconfiguration of hardware or software, and numerous other events that can have potentially disastrous consequences for us as individuals and the organizations that we work for.

To avert situations such as these, organizations are placing increasing importance on cybersecurity. They are making it a higher priority and investing in it accordingly. But how can an organization know if they are investing in the right places? Resources are finite, which means that they need to be selective about what security measures they implement and where they apply their limited security budgets. How can organizations know when they have enough security? How do they know that they’ve attained their security goals when the steps they take are dependent on factors unique to them: what the organization does, how they do it, who’s involved, and why? Everything from culture, to business context, to governing regulation, to geography, to industry can play a role here.

Cybersecurity architecture is one way to systematically, holistically, and repeatably answer these questions. Much as a software architect creates a vision for how to achieve a user’s goals in software or a network engineer creates a vision for how to achieve the performance and reliability targets for network communications, the cybersecurity architect works to create a vision for cybersecurity. This can be for an application, for a network, for a process, for a business unit, or for an entire organization.

This book takes a practical look at the nuts and bolts of defining, documenting, validating, and ultimately delivering an architectural vision. It draws on existing standards and frameworks for cybersecurity architecture, outlining where (and more importantly how) they can be applied to the architecture process in your organization. The book does this by walking through the architecture process step by step, discussing why each step provides the value it does and how to use it to maximum benefit, and provides tips, gotchas, and techniques from numerous working architects in the field to supplement our own perspective.

Who this book is for

This book is primarily for cybersecurity practitioners getting started with cybersecurity architecture or those already following a systematic architecture process who would like to build their skills. For the novice, we walk through the fundamental skills and techniques used in the architecture process and, for those with some experience already, we supplement our viewpoint with that of other architecture specialists currently in the field to help them think about challenges in a new way or adapt strategies that have been successful for others into their own toolkit.

What this book covers

Chapter 1, What is Cybersecurity Architecture?, provides an overview of cybersecurity architecture: what it is, why it’s useful, the business value that it brings to the organization employing it, and the role of the cybersecurity architect within an organization. We highlight the history of cybersecurity architecture, important standards, frameworks, and approaches that the architect can draw upon, and lay out the fundamental requirements for the architect before they get started.

Chapter 2, The Core of Solution Building, helps the architect assess the important touchstones, contextual background, and goals of the organization. Architecture doesn’t happen in a vacuum: the design must be reflective of the organization’s needs, its business, and its mission. This chapter helps the architect understand that context the boundaries around what the organization considers important that will allow the architect to systematically and purposefully take action.

Chapter 3, Building an Architecture – Scope and Requirements, explains that with any project, the outcome must be dictated by what the organization needs. This section presents methods for discovering the scope within which the architect must design as well as the core information about requirements that their solution should address.

Chapter 4, Building an Architecture – Your Toolbox, is all about building out the toolbox that you will need as you approach the design process. Getting your tools ready ahead of time allows you to have them when you need them. Any project you undertake has a set of tools that will let you do the job successfully. With them, the job is easy – without them, there’s nothing harder.

Chapter 5, Building an Architecture – Developing Enterprise Blueprints, outlines how to gather, document, and validate the necessary information that will allow you to create a high-level architectural definition. This lets you select a solution approach that is consistent with what the organization needs, is documented in such a way to protect the organization and streamline efforts, and ensures that technical implementation approaches are optimal.

Chapter 6, Building an Architecture – Application Blueprints, provides specific guidance on application security architecture efforts. In many ways, building a cybersecurity architecture for an application is similar to doing so for the organization in aggregate or for a network. However, because there are different audiences that we must present designs and approaches to (and that we must of necessity work collaboratively with), there are some elements of the process that are different.

Chapter 7, Execution – Applying Architecture Models, walks through how to implement your design concept technically, walking you through elements of execution and realization of the implementation. At this point, you will have created a high-level model, a design that meets the organization’s needs. However, the best ideas on paper don’t actually provide value until they are implemented.

Chapter 8, Execution – Future-Proofing, goes through the process of ensuring that a design (and subsequent implementation) that you’ve deployed stays meaningful over time. It discusses ways to ensure that you keep apprised of changes, that you monitor the effectiveness of your solution over time, and that you build in and adapt instrumentation (such as metrics) to keep things running smoothly after deployment.

Chapter 9, Putting It All Together, closes the book with strategies that you can use to improve your architecture skills, improve the processes you follow, and ensure that with each project you take on you optimize what you do. We present guidance about common issues that architects run into, how to avoid them, and advice for the architect drawn from the experiences of those in the field.


  • 关于本书的内容介绍、目录、详情等请在 AmazonGoolge Books 等售书网站搜索查看,本站仅展示封面作为参考。
  • 如无特殊说明,本站提供的所有pdf均为文字版(aka True PDF or Digitally Created PDF)。
  • 本站已经列出的所有图书均可以找到。
  • 收到PDF链接之后建议尽快下载或者保存到自己的百度网盘,防止链接过期失效。


扫描下方二维码添加微信号 bookyage 回复本书编号 270676 即可,我们会尽快(一般24小时之内)将本书PDF文件以百度网盘链接的形式发送给您。