Instructor: Enterprise security architecture. 2 2
In this lesson, we are going to talk about the importance 3 3
of enterprise security architecture. 4 4
Now, the concept of enterprise security architecture 5 5
goes back to IT governance and IT service management. 6 6
When we talk about IT service management, 7 7
or information technology service management, 8 8
we're really focused on the idea of stakeholders 9 9
picking out the right technologies, 10 10
deploying those technologies, 11 11
and operating those technologies 12 12
for the best benefit of the organization. 13 13
Now, to successfully do IT service management, 14 14
we use framework-based governance. 15 15
Framework-based governance is going to seek to mitigate 16 16
the risks that are associated with IT service delivery. 17 17
Now, when we talk about all of this 18 18
we're really talking about enterprise security architecture 19 19
as I mentioned in the beginning of this lesson. 20 20
Enterprise security architecture, or ESA, 21 21
is a framework for defining the baseline, the goals, 22 22
and the methods that are used to secure the business 23 23
from all those different risks 24 24
that could go against your organization. 25 25
Now, these different frameworks 26 26
that we can put in place under ESA 27 27
can provide us with a lot of different things. 28 28
For example, they can provide us with a list of policies 29 29
and provide us with checklists of procedures. 30 30
They can provide us with activities, 31 31
and they can even tell us what technologies 32 32
we should be using as part of the framework 33 33
and the overall architecture. 34 34
Now, when we deal with frameworks, 35 35
these frameworks are there to help provide 36 36
an externally verifiable statement of regulatory compliance. 37 37
This is really important, especially in some industries 38 38
where regulatory compliance is essential. 39 39
For example, if you take credit cards, 40 40
you need to make sure your in compliance with PCI DSS. 41 41
If you're a healthcare provider, 42 42
you need to make sure you're following HIPAA. 43 43
If you're a financial company or a publicly traded company, 44 44
you might be affected by Sarbanes-Oxley. 45 45
These are things you have to think about 46 46
as you start thinking about the frameworks, 47 47
because these frameworks are going to help us achieve 48 48
that regulatory compliance to make sure 49 49
we are meeting all the requirements 50 50
that lawmakers have put on us. 51 51
Now, there are lots of different frameworks 52 52
that are used in the industry. 53 53
Now, you can choose any of them that you want 54 54
for your organization. 55 55
This really does depend on your organization 56 56
and its IT governance structure. 57 57
This can include things like ITIL, COBIT, 58 58
TOGAF, and ISO 20000. 59 59
All of these are different frameworks 60 60
that fit into this idea of enterprise service architecture. 61 61
Personally, I'm a big fan of the ITIL framework 62 62
and I teach a lot of courses on the ITIL framework, 63 63
but all of these are valid choices to consider. 64 64
Now for the exam, you don't have to memorize 65 65
all the details of each of these different frameworks, 66 66
but learning a well-known framework like ITIL 67 67
can provide you with more career opportunities 68 68
as you go into management and executive levels 69 69
within your organization.