Embed Size (px)
Citation preview
Risk Management in TOGAF&
Risk Modeling in Archimate
Pascal de Koning
March 2017
“TOGAF Security Guide” (G152)
A brief history of attempts to integrate security in TOGAF
Some future
2016
TOGAF Security Guide
Core concepts for Risk Management
In line with ISO31000 (Risk Management), Risk management should be embedded deeply and firmly in all business activities
Core concepts:• Key Risk Areas• Business Impact Analysis• Risk Assessment• Business Risk Model / Risk Register• Risk Appetite• Risk Mitigation Plan / Risk Treatment Plan
Balanced view of Risk
Mapping core concepts to the ADM
White paper
2016
Archimate
• Open Group standard
• open and independent modeling language for EA that is supported by different tool vendors and consulting firms.
• It provides uniform representations for diagrams that describe EAs
Archimate example
2016
White paper objective
• The ArchiMate 3.0 specification makes very brief mentions of risk and security. It identifies risk and security as an important EA aspect that the language does not explicitly address.
• This White Paper provides specific guidance for risk and security modeling by extending the TOGAF standard and using the ArchiMate language. It extends the existing risk and security content of the TOGAF standard using relevant industry standards and leveraging the ArchiMate visual modeling language to:– Cover risk assessment and protection of assets beyond information security– Provide guidance and detailed tools and techniques for constructing specific
models, viewpoints, and patterns that help practitioners to develop security architecture models
– Identify modeling patterns for functions such as authentication and authorization, security auditing, and monitoring
– Provide elements and mapping to the TOGAF ACF and Metamodel
FAIR
• The Open Group Risk Taxonomy (O-RT) standard
• provides a definition and taxonomy for information security risk
• describes the main factors that drive risk, their definitions, and relationships
FAIR Risk Taxonomy
New: Archimate object model for risk
Example Archimate diagram for risk
En verder?
• Lees de white papers
• Gebruik Archimate in architectuurplaten
