The OpenGroup and the SABSA institute in collaboration published the whitepaper titled "TOGAF and SABSA integration: How SABSA and TOGAF complement each other to create better architectures" which delves into the incorporatation of risk management and security architecture approaches into a well established enterprise architecture methodology- TOGAF. Jim Hietala, VP at the Open Group, quotes the following lines from the whitepaper in his blog entry to explain the motive of the effort:
For too long, information security has been considered a separate discipline, isolated from the enterprise architecture. This Whitepaper documents an approach to enhance the TOGAF® enterprise architecture methodology with the SABSA® security architecture approach and thus create one holistic architecture methodology.
The paper starts off with a brief introduction of relevant TOGAF and SABSA concepts for the integration which include: TOGAF Architecture Development Method (ADM), TOGAF Content Metamodel, SABSA Model, SABSA Matrix, SABSA Lifecycle and SABSA Business Attribute Profile. Since both the methodologies are business driven, this aspect is used as the basis to bind the two methodologies together. The following sections in the paper focus on the details of the integration based on the following three principles:
1. Risk management is the driver for the selection of security measures – the SABSA approach to operational risk management is business-driven instead of threat-driven. The business-driven approach also considers the risk context in achieving a positive outcome, whereas the threat-driven approach only looks to minimize or eliminate the possibility of a loss event. This complementary positive view on risk is an essential basis for the TOGAF-SABSA integration.
2. Requirements management plays a central role in successful architecture development – TOGAF follows a requirements-driven approach and SABSA Business Attribute Profiling provides a powerful technique to capture architectural requirements.
3. The TOGAF Architecture Development Method (ADM) is a popular architecture delivery process – this paper shows which security architecture artifacts are relevant to each phase of the ADM, so that the security architecture becomes an integrated part of the enterprise architecture. This way, SABSA is expressed in TOGAF words, providing a common language between TOGAF and SABSA to facilitate better information exchange between practitioners.
and the following three rules for integration:
• When an artifact seems to appear at different levels of the architecture, the highest level of abstraction is used for the mapping. This way, the integration keeps its main focus on the enterprise level. And the enterprise level is exactly where SABSA offers added value.
• When two different mappings are both defendable, the most obvious one is used. This is because the majority of the architects’ community is likely to accept the most obvious mapping, which makes it more practical.
• The scope of the integration is limited to the elements and concepts that are most important and useful.
TOGAF does not specify a requirements management approach so SABSA's Business Attribute Profiling (BAP) approach is used to capture requirements since it defines a risk-based approach to defining requirements based on business goals. The two way traceability between business drivers and security services definitions achieved by linkage of SABSA artifacts is expanded to address alignment of all enterprise services in TOGAF's information system services catalog with business requirements using purely TOGAF artifacts. The TOGAF content metamodel which maintains entity relationships is augmented:
The most suitable location in the current metamodel for the Business Attribute Profile is in the Motivation Extension, at the location of the object “Goal”. Goal has exactly the right relationships, namely with Driver (compare with SABSA business driver) and “Objective” (compare with SABSA control objective).
Finally the paper dives into a detailed analysis and description of the mappings of SABSA artifacts to TOGAF ADM phases which is summarized in the diagram below:
