Risk modeling by custom extensions to Archimate Experimental extensions towards a complete EA framework

Transcription

1 Risk modeling by custom extensions to Archimate Experimental extensions towards a complete EA framework Erik Hagen June 2014 Contact: erik.hagen@entercard.com

2 EnterCard delivers smart payment and financing solutions to customers. We have over 50 card products and 2 million customers across Scandinavia

3 Introduction There are requirements and use cases for EA modeling in many areas solution design, work instructions, IT planning, knowledge management, training, master data, project management, business transformation, incident management, risk management and more. There is currently no single modeling standard that covers all of this. So, we have combined severel EA standards into a larger framework, with modeling conventions independent of any particular tool. (We use ARIS.) Our main effort so far has been as-is documentation in relation to Business Continuity Management and impact analysis, but we are also proceeding in other areas. This presentation is about how the EA framework we have developed so far could cover risk modeling going forward. Note that this presentation does not cover how EnterCard is actually working with risk management today. First, some considerations regarding risk mangement vs. EA... 3

4 SABSA and TOGAF - Integrating security and risk management into enterprise-level architectures For too long, information security has been considered a separate discipline, isolated from the enterprise architecture Operational risk and its relevance to enterprise architecture why incorporating the concept of operational risk is essential to modern enterprise architecture design. This White Paper is intended to guide enterprise and security architects in fully integrating security and risk management into enterprise-level architectures 4 EA

5 The SABSA Operational Risk Model The IT security and information security industry has evolved over its lifetime a view of operational risk that is concerned only with threats, vulnerabilities, and loss events (negative impacts)--- This negative approach to risk management has also found its way into the ISO/IEC 27005:2011 standard Arguably, the sole role of the enterprise architect is to create an operational environment in which operational risk can be optimized for maximum business benefit and minimum business loss. 5 EA

6 Assets at risk primary and secondary In SABSA thinking these operational capabilities are the primary assets at risk examples Production capability, Service delivery capability... Capability to build and sustain brands and reputation «In traditional information and IT risk management frameworks the assets at risk are usually classified as information assets (databases, files, documents, etc.) and IT assets (computer hardware, software, communications networks, etc.). These are regarded in SABSA as secondary assets, supporting the primary assets of business capability SABSA risk assessment, risk measurement, and risk monitoring focuses on the primary assets In this respect SABSA is leading-edge thinking, challenging the traditional IT view of operational risk management, but aligning operational risk with true business risk. 6 EA

7 SABSA Artifacts in the TOGAF ADM 7 EA

8 TOGAF ADM primer Architecture Development Method 8 EA

9 Archimate metamodel mapped to the TOGAF ADM 9 EA

10 EnterCard s modeling conventions based on open standards 10

11 Relevant modeling standards and their relation 11 EA

12 Main Archimate concepts subject-verb-object (in 12 «Chinese»)

13 Archimate symbols «the alphabet» 13

14 Additional symbols Business rules (DMN) User stories and use cases Test cases Risk modeling Various other symbols 14

15 Archimate viewpoints «the sentences» Archimate is currently missing viewpoints for risk, capability (and some more) 15 EA

16 Additional/custom viewpoints 16 EA

17 Custom «Relationship Roles» associated with associated with (master stored by) associated with (copy stored by) associated with (groups) associated with (provides) associated with (supports) associated with (delivers) associated with (changes) associated with (defines) associated with (signs) associated with (may exploit) associated with (defined by) accesses accesses (reads) accesses (creates) accesses (updates) accesses (deletes) accesses (consumes) accesses (produces) used by uses realizes realizes (copy of) realized by assigned to assigned to (resides on) assigned to (fulfills) assigned to (performs) assigned to (responsible) assigned to (accountable) assigned to (consulted) assigned to (informed) aggregates composed of generalization of influences influences (triggers) influences (mitigates) influences (resolves) influences (leads to) influences (results in) influences (may result in) influences (implies) influences (impacts) 17

18 Risk & Impact viewpoint (custom) Asset at risk: Any object, including capability Planned enhancements: Threat agent Opportunity 18

19 Assets at risk «Indirect impacts»: SABSA based view of primary vs. secondary assets: SABSA view: The output of architecture work is the creation of operational capability. These operational capabilities are the primary assets at risk. Example: Capability to build and sustain brand and reputation Example: An incident related to e.g. an IT system «indirectly» impacts «Reputation» Either way, we can model it 19

20 Example impact viewpoint 20

21 Report example impact analysis with output to Excel Export of raw data to Excel for flexible analysis 21

22 Navigating into our repository 22 EA

23 The «complete» picture 23

24 Mandatory deliverables for new projects 24

25 Template catalog 25 EA

26 Easy access to templates and education «Document chapter» Click the template and get started modeling General viewpoint description Examples 26

27 A template example (Archimate Business Process) EnterCard, 18 December, 2012

28 Keep it simple risk attribute for BPMN tasks BPMN process modelers can choose to specify a Risk attribute, in which case an «attribute symbol» is automatically inserted. More advanced modelers can create connected Archimate models (with extensions) EnterCard, 18 December, 2012

29 Change management is key Library contents C h a n g e reuse Project deliverables QA m a n a g e m e n t 29

30 Anticipated extensions to the modeling framework SABSA s Business Attribute Profiling and Business Attribute Taxanomy The Open Group s Risk Taxanomy (O-RT) EA

31 Conclusions Building on the Archimate metamodel enables us to consistenly model the entire enterprise architecture with full traceability between risks and assets. This modeling framework supports traditional risk modeling with a focus on threats and negative impacts as well as e.g. the SABSA approach which also deals with opportunites and positive impacts. Consequently, architecture and risk go hand in hand and marries business improvement 31 EA

32

33 Bonus slides 33 EA

34 The SABSA Matrix 34 EA

35 SABSA Business Attribute Profiling Alignment in the SABSA Matrix between Business Drivers and Services through Business Attribute Profiling 35 EA

36 SABSA Business Attribute Taxonomy 36 EA