Aggregated enterprise architecture wisdom
By John Linford, Security Portfolio Director, The Open Group, and Corinne Brouch, Director Learning and Certifications, The Open Group.
Since the publication of the NIST Cybersecurity Framework (CSF), Version 2.0, the Security Forum has been working to understand the implications of changes to the CSF and making changes to The Open Group Open FAIR™ Body of Knowledge to ensure consistency with the changes.
Written by:
Denny Wan, Reasonable Security
James Middleton, Nationwide Insurance
Melissa Melancon, Kyndryl
John Feezell, Kyndryl
John Linford, The Open Group
“Practice what you Preach”
Hindsight is a powerful thing. Cyber defenders often bear the brunt of the blame for “preventable” cyber incidents that are attributed to a failure to apply available patches in a timely manner. For example, Veracode found that 1 in 3 applications (38 percent) still use vulnerable versions of Log4j two years after the vulnerability was disclosed and patches were made available[1]. It is easy to allocate blame for the failure to patch, but it is not the full story.
The first three posts of this series have laid plain the need to supplement ongoing threat modeling activities with quantitative risk analysis, such as the process described in The Open Group Open FAIR™ Body of Knowledge. They’ve briefly discussed a way to incorporate Open FAIR Risk Analysis in the threat modeling process and illustrate how the results would improve return on security investment by deliberately selecting cost-effective combinations of controls. But questions remain:
By Simone Curzi, Principal Consultant, Microsoft; John Linford, Security Portfolio Forum Director, The Open Group; Dan Riley, Vice President & Distinguished Engineer Data Science, Kyndryl; Ken St. Cyr, Sr. Cybersecurity Architect, Microsoft
Understanding the risks present in the system you are developing is important, but it is even more important to determine mitigation actions. Activities like threat modeling can help with identifying your options, but they are usually too numerous and too expensive. What should you really do? And would the residual risk be acceptable afterwards?
By Simone Curzi, Principal Consultant, Microsoft; John Linford, Security Portfolio Forum Director, The Open Group; Dan Riley, Vice President & Distinguished Engineer, Data Science, Kyndryl; Ken St. Cyr, Sr. Cybersecurity Architect, Microsoft
Threat Modeling and Open FAIR™ Standard, a standard of The Open Group, can answer some of the most important questions we have currently on Security. With this second blog in the ‘Improving Return on Security Investment’ series, we try to answer one of those key questions: “How much security is enough?”
For most, Security is a cost. Therefore, it is important to get just the right amount of it, and no more. But how do you decide when you have enough Security, and what do you do to get it? That’s an entirely different matter. This is the first post of a series on how to Improve the Return on your Security Investment with Threat Modeling and Open FAIR.
By Ash Patel, Marketing Specialist, The Open Group.
The Open Group hosted a virtual event on Enterprise Architecture (EA) for Sustainability July 25 – 27, 2023, assembling leading industry and global subject matter experts. The event looked at Enterprise Architecture (EA) helping organizations identify sustainability goals, along with focusing on the TOGAF® User Group, and The Open Group India Awards for Innovation and Excellence. Here are our key highlights and takeaways from across the three days.
By Ash Patel, Marketing Specialist, The Open Group
We briefly met up with Andrew Josey, Fellow and VP of Standards & Certification at The Open Group Summit in London to discuss the latest learning paths aimed at IT practitioners and Enterprise Architects. Thank you to Andrew for his time. Please see the full interview below
By Ash Patel, Marketing Specialist. Recently we reached out to John Linford, Security & OTTF Forum Director, for The Open Group, to discuss his role, industry advice, updates within his Forum and lots more. Thank you again to John for his time and for giving us an expansive look into his Forum at large. Please see the full interview below:
By Chris Frost, Principal Enterprise Architect, Application Technology Consulting Division, Fujitsu.
The Open Group has a great set of Standards for digital business. These have evolved over time as members have collaborated to create the standards we need for our businesses.
By Jim Hietala, VP of Security and Business Development, The Open Group and John Linford, Forum Director, Security and Open Trusted Technology Forums, The Open Group.
Open FAIR has seen rapid and extensive adoption in the US, where it has become the defacto standard for quantifying cybersecurity risk. We at The Open Group are encouraged that Open FAIR awareness and adoption are also increasing globally, and we’ve also seen some increased usage outside of the traditional IT risk quantification area. Some interesting recent developments on increased Open FAIR use and adoption outside of the US, and outside of the IT area include:
Last week, our Open Digital Standards July 2021 event brought together vendors and end-user organizations from across the globe to discuss how the cross-industry development of open standards is helping businesses become digital-first. It was fantastic to have over 1,040 attendees from more than 90 countries gather virtually to discuss this critical roadmap to digital transformation.