SABSA, which stands for Sherwood Applied Business Security Architecture, is a comprehensive and integrated framework and methodology for developing effective security architectures and strategies within an organization. It was developed by John Sherwood in the 1990s and is widely used in the field of information security and enterprise architecture. SABSA focuses on aligning an organization’s security measures with its business objectives and risk management requirements. Here are key aspects and components of SABSA:
Business-Driven Approach: SABSA is fundamentally a business-driven approach to security. It starts with a deep understanding of an organization’s business strategy, goals, and objectives. Security measures are then designed and implemented to support and enable these business objectives.
Risk Management: SABSA places a strong emphasis on risk management. It helps organizations identify, assess, and prioritize risks to their information assets and business processes. This risk-centric approach ensures that security efforts are directed where they are needed most.
Six Layers of the SABSA Framework: SABSA is structured into six layers, each of which represents a different perspective or aspect of the security architecture:
- Business Goals and ObjectivesThis layer defines the business context and objectives that the security architecture must support.
- Information LayerAddresses the information assets that need protection and how they are classified and managed.
- Application LayerFocuses on the applications and systems used to process and store information, including their security requirements.
- Data LayerDeals with the data itself, including its classification, protection mechanisms, and data lifecycle management.
- Technology LayerAddresses the underlying technology infrastructure, including networks, devices, and platforms, and how they are secured.
- Physical LayerConcerned with the physical aspects of security, such as access control, surveillance, and environmental controls.
Security Services: SABSA defines a set of security services that can be tailored to an organization’s needs. These services include authentication, authorization, encryption, monitoring, and incident response.
Security Attributes and Metrics: SABSA helps organizations define and measure security attributes, which are characteristics of the security architecture, and security metrics to track the effectiveness of security controls and processes.
Lifecycle Approach: SABSA provides guidance for the entire security lifecycle, from initial design and implementation through to operation, monitoring, and continuous improvement.
Certification and Training: SABSA offers certification programs for individuals to demonstrate their proficiency in the framework. Training and certification help professionals apply SABSA principles effectively.
Compliance and Governance: SABSA aligns with regulatory compliance requirements and governance frameworks, helping organizations meet legal and regulatory obligations.
Integration with Other Frameworks: SABSA can be integrated with other frameworks such as TOGAF, COBIT, and ISO 27001 to create a comprehensive approach to enterprise security and governance.
SABSA is particularly well-suited for organizations that want to take a strategic and business-focused approach to information security. It provides a structured and adaptable framework that helps organizations design security architectures that are closely aligned with their business objectives, risk profiles, and compliance requirements.
Key terms in plain language
Open a term for a concise explanation of language used on this page.
Cybersecurity
The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.
Zero Trust
A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.
SASE
Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.
Identity and Access Management (IAM)
The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.
Multi-Factor Authentication (MFA)
A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.
MDR / XDR
Security services and tools that monitor activity, investigate suspicious behavior, and help contain threats. MDR is managed detection and response; XDR correlates signals across multiple security layers.