Overview
SABSA® is the world’s leading open security architecture framework and methodology. SABSA is a top-to-bottom framework and methodology to conceive, conceptualise, design, implement and manage security in a business-driven model.
The term ‘business-driven’ is the key to SABSA’s power, and its acceptance. SABSA is all about empowering the organisation to do business as it needs and wants to do, while ensuring that it is secured and fully enabled. SABSA is an open and inclusive standard that readily integrates with other frameworks and tools such as ITIL, 17799/27000 series, COBIT and the like. It can be used as a compliance and governance framework for complex sets of standards.
SABSA is used commonly as the security parallel and tool set for organisations using the world’s leading IT Architecture
Framework – Zachman.
Prerequisite
The SABSA Foundation Level certification neither requires nor assumes any experience in any branch of security.
Audience
CIO / CISO / CRO / CIRO
IT Strategists and Planners
IT Architects
IT Development Managers and Project Leaders
Software Managers and Architects
Computer / Information Security Managers, Advisors, Consultants & Practitioners
IT Line Managers
IT Service Delivery Managers
Risk Managers
Internal and External Auditors
Content
Module F1: Security Strategy & Planning
This module provides participants with a comprehensive understanding of how the SABSA framework delivers successful security strategy and architecture. Through a series of innovative presentations, case studies and workshops, you will develop the skills to use the most proven security architecture design and management processes
Course Outline :: SABSA Foundation ::
and find out how to develop a comprehensive strategy for the creation of a security architecture that genuinely meets the needs of your organisation:
THE SABSA FRAMEWORK
- 1. Information Security Strategy, Benefits and Objectives
Security: A Cultural Legacy as a Business Constraint
Technical Legacy of Tactical Point Solutions
Security Strategy, Tactics and Operations
Critical Success Factors for Business, IT and Security
Measuring and Prioritising Business Risk
Enabling Business and Empowering Customers
Adding Value to the Core Product
Protecting Relationships and Leveraging Trust
- 2. Introduction to SABSA Best Practice
Information Security and its Role in the Modern Enterprise
Enterprise Security Architecture: Definition and Principles
The History of SABSA Development
Introduction to the SABSA Model
The Business View of Security: Contextual Architecture
The Architect’s View of Security: Conceptual Architecture
The Designer’s View of Security: Logical Architecture
The Builder’s View of Security: Physical Architecture
The Tradesman’s View of Security: Component Architecture
The Service Manager’s View of Security: Operational Architecture
Traceability from Business Requirements to Deployed Solutions
The SABSA Matrix and Service Management Matrix
INFORMATION SECURITY STRATEGY
- 3. Business Requirements & How To Define Them
Business Goals, Success Factors and Operational Risks
Business Processes and the Need for Security
Location Dependence of Enterprise Security Needs
Organisation and Relationships Affecting Enterprise Security
Time Dependency of Enterprise Security
Collecting Enterprise Requirements for Security
Creating a Business Attributes Profile
Defining Control Objectives
Course Outline :: SABSA Foundation ::
- 4. Strategic Concepts & How To Apply Them
Managing Complexity
Systems Engineering for Security
Architectural Layering
End-to-End Security
Defence-in-Depth Models
Security Domains
Security Associations
Trust Modelling
Organisation & Workflow
Infrastructure Strategy
Management Strategy
SABSA PRACTITIONER GUIDE
- 5. The Strategy Programme & Architecture Delivery
The SABSA Development Process
The SABSA Lifecycle
Strategy and Concept Phase Processes and Sub-processes
Design Phase Processes and Sub-processes
Implement Phase Processes and Sub-processes
Manage and Measure Phase Processes and Sub-processes
Top-down Decomposition of the SABSA Model
Scope, Deliverables and Project Sequencing
- 6. Managing The Strategic Programme
Introduction to Return on Investment & Return of Value
Defining the Benefits and Value Propositions
Selling the Benefits
Getting Sponsorship and Budget
Building the Team
Team Competency Assessment & Development
Programme Planning and Management
‘Fast Track’ Start-up Programmes
Collecting the Information You Need
Gaining Consensus on the Conceptual Architecture
Strategic Architecture Governance, Compliance and Maintenance
Identifying Quick Wins and Gaining Long Term Confidence
Course Outline :: SABSA Foundation ::
Module F2: Security Service Management
This module leverages the strategy defined in Foundation Module One to create the roadmap to design, deliver and support a set of consistent and high-quality security services. Covering the good practice lifecycle, participants will find out how to design, deliver and support a comprehensive security services architecture that integrates fully and seamlessly with their existing IT management and business infrastructure and practices:
THE SABSA SECURITY MANAGEMENT FRAMEWORK
- 1. The SABSA Security Management Framework
SABSA in the I.T. Lifecycle
Using SABSA To Integrate Other Methods, Models & Standards
SABSA and the ITIL Framework
SABSA and CobIT
SABSA and Project Management Standards
SABSA and ISO Security Standards
SABSA and IT Architecture
THE SABSA SECURITY POLICY AND RISK MANAGEMENT FRAMEWORK
- 2. Security Policy Management
Policy Principles
Policy Content, Hierarchy & Architecture
Security Policy Making
Information & Systems Classification
Third Party & Outsourcing Strategy & Policy Management
- 3. Operational Risk Management
The Meaning of Risk
Risk Philosophy & Methodology
Corporate Governance & Enterprise Risk Management
Risk Measurement and Risk Assessment
Risk Mitigation
Risk Appetite
Risk Management Tools
Measuring Success of Risk Management
Course Outline :: SABSA Foundation ::
THE SABSA INTEGRATED ASSURANCE MANAGEMENT FRAMEWORK
- 4. Security Organisation & Responsibilities
Security Governance
Security Culture Development, Training & Awareness
Ownership & Custody
Service Provider & Customer Roles in Security Management
Enterprise Audit & Review Framework
- 5. Assurance of Operational Continuity
Business Continuity Planning
Contingency Planning
Crisis Management
Business Recovery Planning
- 6. Systems Assurance
Technical Assurance of Security Correctness & Completeness
Managing the Assurance Process for Systems & Software Development
Assuring Integrity and Acceptable Use of Systems & Software
Principles of Multi-phased Testing
SECURITY SERVICES DESIGN
- 7. Security Services Architecture
Information as the Logical Representation of Business
Logical Entities & Their Relationships
Using Trust Models to Define Security Services
Security Domains, Domain Definitions & Associations
Security Processing Cycle
- 8. Security Infrastructure Services
Security Rules, Practices & Procedures
Security Mechanisms
User Security
Platform & Network Security
Infrastructure for Service Delivery
Technical Standards & Components
Course Outline :: SABSA Foundation ::
SECURITY SERVICES DELIVERY & SUPPORT
- 9. Operational Security Services
Incident Management
Incident Response
Problem Management
Change Management
Continuity, Crisis & Recovery Management
- 10. Security Administration & Management
Security Service Management
Security Mechanism Management
Security Component Management
System Management & Administration
User Management & Administration
Security Audit Management
Security Operations
Product Evaluation & Selection
SECURITY SERVICES PERFORMANCE MEASUREMENT
- 11. Return on Investment & Return of Value
Return on Investment
Net Present Value
Internal Rate of Return
Defining Value Metrics
Business Attributes & Return of Value
- 12. Security Measures & Metrics
Why Do We Need Measures & Metrics
Measurement Approaches
Defining Metrics
Benchmarking Security
Remedial Project Planning
Maturity Models Applied to Security
Course Outline :: SABSA Foundation ::
Examination
Live Virtual Training – For students who attend a virtual SABSA course with ALC – you will be invited to sit an online exam held at a set date & time the week following the course. The exams are web-based and run via Synap &
ProctorExam. Exact details on the exam date & time are provided at the time of booking.
Face-to-Face Training – Participants will be provided with a paper-based exam which is completed whilst at the course in the same venue of the course itself.
Each exam is of one-hour duration and contains 48 multiple choice questions. The SABSA Foundation Certificate is issued to candidates who pass both Foundation Level exams.
The SABSA Foundation exams:
There are two exam papers, corresponding to the two SABSA modules
Each exam is of one-hour duration and contains 48 multiple choice questions. The total exam duration is two hours.
The exam is closed book format
The SABSA Foundation Certificate is issued to candidates who pass both Foundation Level exams.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.