Security Architecture Design
The Open Group has created an Enterprise Security Architect certification. One of their first certified architects has subsequently created a few enterprise security reference architectures.
The SANS Institute hosted three “What Works in Security Architecture” Summits.
The IEEE initiated a Center for Secure Design. The Center published a “Top 10 Design Flaws” booklet.
Adam Shostack published Threat Modeling: Designing for Security, and renown threat modeler, John Steven, has told me that he’s working on his threat modeling book.
Anurag Agrawal of MyAppSecurity has been capturing well-known attack surfaces and their technical mitigations within his commercial threat modeling tool, “Threat Modeler.
Choose 2 or 3 three items from the list above and provide an update to their development status.
Sample Solution
- The Open Group Enterprise Security Architect certification: The Open Group has continued to develop and refine the Enterprise Security Architect certification. The most recent version of the certification, released in 2022, includes a greater focus on cloud security and threat modeling. The certification is still considered to be one of the most respected certifications for enterprise security architects.
Full Answer Section
- The SANS Institute “What Works in Security Architecture” Summits: The SANS Institute has hosted a total of five "What Works in Security Architecture" Summits. The most recent summit was held in 2023. The summits have brought together leading security architects from around the world to discuss best practices and emerging trends in security architecture. The summits have been well-received by the security community and have helped to raise awareness of the importance of security architecture.
- The IEEE Center for Secure Design: The IEEE Center for Secure Design is still active and continues to publish research on secure design. The center has also developed a number of educational resources on secure design, including a training course and a toolkit.
- Adam Shostack's Threat Modeling: Designing for Security: Threat Modeling: Designing for Security is still considered to be a valuable resource for threat modeling practitioners. The book has been translated into several languages and has been used by security professionals around the world.
- John Steven's threat modeling book: John Steven's threat modeling book is still in development. Steven has been working on the book for several years and has shared some of his thoughts on threat modeling on his blog. The book is expected to be published in 2024.