T4 “BASC Presentation on Security and Application Architecture”

No ratings

Presented at RochesterSecuritySummit 2015 by

Walt Williams

This presentation looks at the relationship between security architecture and application architecture, specifically on the impact on application security from recent proposed changes to the Clark-Wilson integrity model. I’ll explore those changes in depth, discuss the implications for application design. I’ll also discuss the implications of these changes to distributed application architectures such as service oriented architectures and other distributed models. This presentation is based upon my recent book: Security for Service Oriented Architectures, CRC press, and 10 years of experience working with application security architecture in various corporations. Too many information security professionals lack an understanding of application architecture and how to integrate security architecture into it, often dismissing application security as just layer 7 and assuming that adherence to OWASP recommended controls is sufficient. This, despite clear evidence in the Verizon data breach report that applications are a key point of entry for threat agents. This explores the topic, using a service oriented architecture as the point of intersection. Four examples of how security and application architecture can be interwoven are available as talking points.