Updates, insights, and commentary from the OSA community. Tracking the evolution of security architecture since 2008.
Every security team I have worked with over the past twenty years has had the same problem. They can tell you which controls they have implemented. They can show you compliance dashboards, maturity scores, and audit findings. What they cannot do is answer the one question the board actually cares about: how much risk are we carrying, in money?
Most web applications that handle sensitive data follow a familiar pattern: collect it, transmit it over TLS, store it in a database, and promise users you will look after it. The problem with this model is that you -- the site operator -- can see everything. Your database administrators can query it. A breach exposes it. A subpoena compels it. A rogue employee exfiltrates it.
Every security team faces the same question from the board: how mature are we? Until now, answering that question meant expensive consultants, proprietary tools, or spreadsheets that go stale the moment they are completed. Today we are changing that.
Every CI/CD pipeline is an automated pathway to production. Every automated pathway to production is a potential attack vector. SP-028 addresses the security architecture that sits between these two truths.
A busy week for OSA. We've shipped a completely new icon library, added PCI DSS v4.0.1 compliance mappings, and have some exciting news about what's coming next.
After 17 years of serving the security architecture community, Open Security Architecture has a new home.
One of the OSA team has kindly spent some time updating the CMS template, and modernising the look. It's a holding pattern but it means the site stays supported a bit longer, while we figure out some new content.
Quick update. It has been a long time since the core team provided any significant updates for OSA. We are still interested in developing the ideas in this project and have been discussing moving to a modern platform and workflow.
OSA has an updated template and new CMS thanks to Chris. We have plans for a secure data centre pattern shortly, and will be refreshing the site structure and content in the coming months. Stay tuned.
Just read a great article on Ars Technica covering a 1970 DoD analysis of computer system vulnerabilities...