-: To aid in the development of our policies,
standards, guidelines and procedures,
some organizations look to
enterprise security architecture frameworks,
as I mentioned back in the first lesson of this section.
Now, for the purposes of this lesson,
we're going to look at four of them fairly quickly.
First, we have the Sherwood Applied Business
Security Architecture, also known as SABSA.
SABSA is a risk-driven architecture,
and it seeks to consider the security problem
by thinking about the what, where, when,
why, who and how of a problem.
And they think about this as it intersects
with six different layers.
The operational, component, physical,
logical, conceptual and contextual layers.
Next, we'll consider COBIT.
COBIT stands for the Control Objectives
for Information and Related Technology.
And it's a security controlled development framework
that divides IT into four domains.
Plan and Organize, Acquire and Implement,
Deliver and Support, and Monitor and Evaluate.
Each of these domains is then broken down
into one of 34 other processes.
And this is very similar
to other service management frameworks.
Like ITIL or ISO 27000.
Next, let's take a quick look
at the NIST Special Publication 800-53.
This is a security control framework
developed by the U.S. Department of Commerce.
Each control is placed into one of three categories.
It is technical, operational or management.
We talked about this
back in our security controls lesson.
Each of these classes contains
numerous security controls as well.
And if you're working for a Government Agency,
you're likely going to be using the framework
that is the NIST Special Publication 800-53.
Now there's also an international framework
for information securities standards.
And this is known as the ISO 27,000 series.
And it also has the same kind of concept.
Finally, let's talk a moment about ITIL.
ITIL is a framework that used to be known
as the IT Infrastructure Library,
because it was very focused on service operations
and security of your networks.
But it has grown into something larger now,
with the new ITIL four.
ITIL is still the de facto standard
for IT service management.
But now it's being expanded
to include all sorts of
other service based connections
that we have with our organizations,
to provide value to our end users.
These days you may not even be running your own servers.
And yet you're still an IT service organization.
For example, we are a digital services training company,
but we don't even run our own website anymore.
Instead our partners do,
and we oversee those functions.
ITIL is very comprehensive for organizations
who may have their own servers,
contracted services and servers, and much more,
as their all integrated
into the single value chain
to support your users, and your customers.
Now for the security plus exam,
you don't need to know ITIL in depth.
But, I would recommend checking out
and ITIL four course,
because most employers rely heavily on ITIL
for their operations.
And being able to discuss ITIL, it's processes,
and it's concepts is a great thing to have
in your back pocket during a job interview.
After all, ITIL is the language of IT operations,
and as security professionals,
we need to fit in to that system effectively.
Now, in the security plus exam,
you're not going to be asked
a lot of questions about frameworks.
But you should know that there are frameworks
that exist, such as SABSA, COBIT,
the NIST Special Publications,
ISO 27000 and ITIL.
On the exam, the most I would expect you to see
on the exam about frameworks,
is the fact that we use frameworks
as a basis for our policies, our procedures
and our standards.