Lesson 5 - Enterprise Security Architecture

I've said a lot on the topic of security in this little blog because I live it everyday through my job as a DoD Contractor.  Yet still there are security breaches that happen all the time.  I have 3 letters from OPM (Office of Personnel Management) about the probability of my information having been stolen during their well publicized breach.

The problem with Enterprise Security Architecture is that it is very difficult.  It crosses every other pillar in the entire enterprise.  Really, I think it should be the foundation.  Don't get me wrong, I don't like having to deal with security because it can be a real pain.  But it's necessary.  And it has to be done with constant vigilance because security changes even faster than the technology.

Currently my organization is going through the RMF (Risk Management Framework) process for one of our networks (we have several of varying classifications and purposes).  The process basically lays out our entire architecture and the security it has.  This security ranges from the machines to the physical cable installations.  It's that detailed.

What makes security a pain is that detail and the governance required.  Its all encompassing nature is why it's so complicated.  The only truly secure computer is one that is turned off.  Again, it goes beyond that.  For example in the DoD we have rules about cables.  Anything that is unclassified can be copper cable (normal CAT 5E or 6).  Anything ABOVE that can also be copper, but only if it's a secure space and even then it can not be in the same cable tray as unclassified.  The preferred option is that anything above normal unclassified (there are different levels of unclassified) be fiber optics.

I think back to years ago when we used to rotate tapes to an offsite location.  Those tapes were not encrypted.  Sure, they were carried by secure couriers but the media themselves were not.  That would never fly now.  Even our disks have built in encryption.  That's what I mean by security encompasses everything and should almost be the foundation that we build the architecture on.