Applying evidence of vulnerabilities to support architectural design and change

To support this post i am going to assume that a vulnerability or weakness is due to a failing of the architectural design and development process to identify or mitigate the chance of exploitation. That failing may be due to lack of experience, legacy practice or an oversight in the evaluation and appraisal of the solution before it is deployed.

Depending upon the size and complexity of your architecture, determining how vulnerable your organisation is without the support of vulnerability scanning technology is difficult. That said, it is not difficult to introduce at various points of the architectural cycle the necessary evidence of known external  or internally discovered vulnerabilities to support new projects or change existing deployed architecture. Using TOGAF as an example, evidence should be included in stages B, C, D and E as well as stage H. All evidence collected should be included in the architectural repository. [From a wider security perspective it is also useful to consider more general application of security to architecture through the benefits of SABSA (Sherwood Applied Business Security Architecture) and TOGAF together.] More information on SABSA.

If we begin with the external evidence research there are numerous good sources of vulnerability information available on the internet. If starting this exercise for the first time i would recommend the Verizon Data Breach Investigation reports. These reports provide some excellent insights into the exploitation of vulnerabilities and attack types. To quote an insight from the Verizon report:

  • Opportunistic attacks: The victim isn’t specifically chosen as a target; they were identified and attacked because they exhibited a weakness the attacker knew how to exploit.
  • Targeted attacks: The victim is specifically chosen as a target; the attacker(s) then determines what weaknesses exist within the target that can be exploited. [Source Verizon]

The latest Verizon report provides more detail on the statistics and background to weaknesses or vulnerabilities exploited by attackers and it also shows that Hackers still very much rely on vulnerabilities as a means to gain access to an organisation’s environment.

A second area of research should focus on the more detailed reporting of vulnerabilities so that the research begins to align to the context or your organisational architecture. I would recommend CERT Division of the Software Engineering Institute (SEI) and Common Vulnerabilities and Exposures (CVE®).

Internally, the common ways to research necessary evidence for architectural change comes from the following operational capabilities:

  • Vulnerability Management
  • Patch Management
  • Intrusion Detection
  • Security Incident Management

What you determine internally will be dependent upon how mature these capabilities are in your organisation and what data or reports you are able to collect.  That is where the rest of the evidence model is able to help with the assessment and development of the material collected and produced. The application of the evidence model is there to help decide what is required to create a report or monograph to support architectural decision making and underpin the strength of the arguments stated in the evidence.

I am going to continue this thread by looking at Risk and Threat information as evidence as the three areas of risk, threat and vulnerability compliment each other. The combination of the three areas should mature the architectural thinking especially around the evaluations  and overall hypotheses made.


Enterprise Architecture and Cyber Defence Ontology

Having not had the opportunity to continue this blog and the theme of using semantics to develop the evidence based enterprise these last few years i am going to begin again with a new area of focus. The focus will be a series of posts and models covering Cyber Defence and Enterprise Architecture, an area i have been working in these last four years. I am going to start with some basic principles to cover what i will exploring:

  • Enterprise Architecture patterns (including conceptual models, building blocks etc) represent the basis for evidence based EA
  • A pattern should have a specification and qualification, at a minimum a metamodel or an ontology to provide that specification and qualification
  • Evidence, broadly construed, is anything presented in support of an assertion. This support may be strong or weak. The strongest type of evidence is that which provides direct proof of the truth of an assertion. (Wikipedia Definition)
  • Evidence should be derived from domains within the organisation through recorded instances and lessons and classified through domain ontologies.
  • EA patterns qualified by ontological models creates an evidential design process

So i am going to use an Enterprise Architecture Ontology, a Cyber Defence Ontology, a Security Ontology and an ITIL Service Management Ontology to provide the qualification and the guidelines for evidence within architectural patterns. So an ontology in the context of an architectural guideline or pattern representation is a specification of conceptualizations (from enterprise architecture and security domains) that constitutes evidence-based architectural practice. The evidence would be drawn from security frameworks or security operations demonstrating where weak or vulnerable architectural solutions have failed to prevent a cyber attack.  For example, an architectural guideline or pattern would define a set of key concepts,  decisions and actions (also concepts), as well as a set of rules (relationships) that relate the evaluation of a security decision criterion to further reasoning steps or to its associated actions. Thus enabling security restrictions or policies to enhance an architectural pattern (through Architectural and Solution Building Blocks) and improve the security aspects of a physical deployment of the future solution.

I have attached to this post a series of high level images of the Ontologies and SKOS models i will be using. The service technology model is an example the integration between the Cyber Defence Ontology, the Enterprise Architecture Ontology and the ITIL Ontology. At a high level it shows the relationships between the controls of the enterprise technology architecture, which defines the product, supplier management with a supporting actor of Security Operations, SOC supplier management and the deployed product used by Security Operations. At a further level of detail the three ontologies are able to show the interfaces between the three distinct business units (Service Management, Security Operations and Enterprise Architecture) thus providing an operating pattern for their interaction, collaboration and in particular the incident and change management processes necessary for in-life support.

Cyber SKOS

ITIL Ontology

Enterprise Architecture Ontology

Srvice Technology Model

Security Framework Ontology

Cyber Defence Ontology Model

Zachman Enterprise Ontology

It was interesting to read today that the Zachman website has now published the Zachman Framework Version 3 and refers to it as an enterprise ontology. Here is a quote from the website:

The Zachman Framework™ is an ontology – a theory of the existence of a structured set of essential components of an object for which explicit expressions is necessary and perhaps even mandatory for creating, operating, and changing the object (the object being an Enterprise, a department, a value chain, a “sliver,” a solution, a project, an airplane, a building, a product, a profession or whatever or whatever).

The Zachman Framework™ IS NOT a methodology for creating the implementation (an instantiation) of the object. The Framework IS the ontology for describing the Enterprise. The Framework(ontology) is a STRUCTURE whereas a methodology is a PROCESS. A Structure is NOT a Process. A Structure establishes definition whereas a Process provides Transformation.

Processes based on ontological structure will be predictable and produce repeatable results (for example, Chemistry, based on the Periodic Table).

It is quite an announcement to make that the framework is an ontology and i hope a formal OWL or Frames based model will follow. For more information visit

Article – evidence based management and productivity

Here is an interesting article on how evidence based management can boost productivity.

What i like about this article is the fact that the research team found that those companies, using data driven decision making, had output and productivity that was 5-6% more than expected. There is also a link to the full report.

An evidence based enterprise

Is the enterprise of the future an evidence based enterprise? It is an interesting question and as the number of business functions exploring an evidence based approach grows, then perhaps there will be a tipping point towards its acceptance.

Every organisation has a different view of how technology can influence how they do business. Perhaps this is best explained using the old term from the late 90s when enterprises were either Bricks and Mortar or Dot Coms. Whilst this does not mean that one is more or less likely to adopt evidence based practice a smaller more agile organisation should have the advantage because their thinking may be more progressive.

I think the adoption will depend upon the type of organisation and the culture it instills. Technology has the ability now to communicate with every single person in an enterprise, no matter how large it is, via email or the internet. Thus, it has the ability to deliver information to every person so that they can use it to perform the activities they do. Therefore technology is able to put evidence in the hands of everyone that makes a decision. So a culture that exists with the belief that evidence is important combined with a pioneering view of using technology in the workplace, like the dot coms, should be better placed to leverage information and technology to make better decisions.