Nownet Security
Home / Services / Security architecture
Service

Business-driven security architecture

Security architecture built on SABSA, so every control traces back to a business requirement. The result is security that leadership understands and engineering teams can build.

Discuss your needs

Why SABSA

SABSA starts from what the business needs to protect and why, then works down to the controls that achieve it. That traceability makes it easier to justify spend, explain risk to non-specialists and show regulators that controls are proportionate.

What's included

  • Architecture practice set-up: establishing a security architecture function, its governance and how it engages with delivery teams
  • Identity and access design: OAuth 2.0, OpenID Connect, token lifetimes, step-up authentication and privileged access management
  • Cloud-native and microservices platforms: security patterns for AWS and Azure, from landing zones to service-to-service trust
  • Design assurance: reviewing solution designs against your security requirements before they're built
  • Enterprise alignment: fitting security into TOGAF-based enterprise architecture

How an engagement runs

  1. Business attributes. Agree what matters most to the business: availability, integrity, confidentiality, compliance.
  2. Architecture. Define the security services, patterns and standards that deliver those attributes.
  3. Design support. Work with engineering teams so the patterns are built as intended.
  4. Governance. Leave a repeatable process for reviewing new designs.

Relevant experience

Digital banking platform

Led around 15 security architects on a greenfield, cloud-native core banking platform for a tier-one bank, taken live under PCI DSS, ISO 27001, SOX and GDPR.

Frequently asked questions

What is SABSA?

SABSA (Sherwood Applied Business Security Architecture) is a framework for building security architecture from business requirements. Each control can be traced back to the business reason it exists.

Can you help set up a security architecture function?

Yes. We have founded a security architecture practice from scratch for a global payments business, including its governance and ways of working with delivery teams.

Do you work on cloud-native platforms?

Yes. Our work includes cloud-native banking on AWS and Azure, with microservices, identity federation and short-lived credentials.