Preface

Cybersecurity is quickly becoming a "make or break" topic area for most businesses. We all can cite numerous examples of headlines describing security issues, notifications from companies or online services that we use, and (in some cases) even breaches that have impacted organizations that we've worked for. We all know the stories of vulnerable software, scammed users, accidental misconfiguration of hardware or software, and numerous other events that can have potentially disastrous consequences for us as individuals and the organizations that we work for.

To avert situations such as these, organizations are placing increasing importance on cybersecurity. They are making it a higher priority and investing in it accordingly. But how can an organization know if they are investing in the right places? Resources are finite, which means that they need to be selective about what security measures they implement and where they apply their limited security budgets. How can organizations know when they have enough security? How do they know that they've attained their security goals when the steps they take are dependent on factors unique to them: what the organization does, how they do it, who's involved, and why? Everything from culture, to business context, to governing regulation, to geography, to industry can play a role here.

Cybersecurity architecture is one way to systematically, holistically, and repeatably answer these questions. Much as a software architect creates a vision for how to achieve a user's goals in software or a network engineer creates a vision for how to achieve the performance and reliability targets for network communications, the cybersecurity architect works to create a vision for cybersecurity. This can be for an application, for a network, for a process, for a business unit, or for an entire organization.

This book takes a practical look at the nuts and bolts of defining, documenting, validating, and ultimately delivering an architectural vision. It draws on existing standards and frameworks for cybersecurity architecture, outlining where (and more importantly how) they can be applied to the architecture process in your organization. The book does this by walking through the architecture process step by step, discussing why each step provides the value it does and how to use it to maximum benefit, and provides tips, gotchas, and techniques from numerous working architects in the field to supplement our own perspective.