Enterprise Information Security Architecture
Definition: Enterprise Information Security Architecture (EISA) is the process of
instituting a complete information security solution to the architecture of an enterprise,
ensuring the security of business information at every point in the architecture.
The security of commercial data has always been a primary concern in business. Both for
ensuring the safety and integrity of customer data and protecting the competitive advantage
that comes with superior
business intelligence, information security is vital.
While security has always been a concern, it has become even more so since the introduction
of the Internet. Whereas in the past enterprises needed only to protect the flow of information
 within the business, today they must consider the threat from outside – from attacks on the
security of the corporate Intranet, for instance, or electronic data interchange (EDI) between
the enterprise, clients and suppliers.
EISA is not, however, simply a matter of building a wall between the IT systems of an
enterprise and the outside world. Instead, the security architecture must align with the strategies
and objectives of the enterprise, taking into consideration the importance of the free flow of
information within an enterprise - and with partners, customers and suppliers.
Aspects of EISA
The goal of the Information Security Architecture
(developed by Gartner) is to align security strategies between three functional areas of an organization:
Business Architecture
Above all else, the security architecture must be aligned with the goals and objectives of the
enterprise. Without proper alignment there will be an inevitable disconnect between business
strategy and security.
To enable this alignment it is vital to accurately outline the business architecture in place to
achieve the objectives of the organization by asking several questions:
What does the enterprise do?
Who does it?
What information do they use to achieve their goals?
Where do they do it?
By answering these questions it becomes possible for the security architecture framers to develop a
comprehensive map of the strategies of the enterprise, along with a range of organizational charts
and business process maps.
Information Architecture
Using these plans, security architecture framers can understand the optimal flow of information within the
enterprise. What applications are used to achieve the objectives of the business? What data do these applications
require in order to achieve those objectives, and what integration methods are in place to enable the sharing of that information?
Only by understanding these technologies and processes can it be possible for the framers to develop a strategy
for ensuring the security of this data while allowing vital business processes to progress unimpeded.
Technology Architecture
Finally, it is necessary to study the technology architecture in place to support these applications and
processes. The technology architecture of most enterprises is highly complex, involving a range of different
technologies running on different platforms, each relying on a range of heterogeneous legacy systems.
Ensuring the security of these technologies while allowing business processes sufficient access to
information can be a daunting task.
In order to ensure the
security of data within this architecture it is necessary to build a map of
every piece of that architecture, and to understand how information moves between its components.
Primarily, it is vital to understand the hardware that supports business processes – the location and
purpose of servers, for instance, and the way in which computers access the information held on those servers.
Perhaps most importantly in the modern day is the need to build an Internet connectivity diagram for
the enterprise. Only by understanding the various connections between the information architecture and
the outside world is it possible to protect those connections.
In a Nutshell
Clearly, the process of developing a functional information security architecture is more complex than it may seem. Not only must the framers of such an architecture be aware of every piece of technology that exists within the business architecture, but they must also understand how and why all of these technologies interact with each other to achieve the objectives of the enterprise. Only once they have this understanding can they set about the task of developing best practices to ensure the security of information passing along these connections while optimizing the passage of information to protect the interests of the enterprise.
|