The Framework Perspective - Information Assurance Architecture - page 307

Figure 11.2 A simple system.

IA architecture, indeed any definition of an effective IA architecture, is contingent
on business need, organizational need and risk tolerances, situational need, avail-
able knowledge, available resources, and time constraints.

11.2.4 Business versus Technical Perspectives

Business people convey their interests in business terms, e.g., customer service,
marketing, balance sheets, and budgets. Technical people convey their interests in
technical terms, e.g., network bandwidth, storage capacity, hits on a firewall, and
the latest technology du jour (e.g., SOA). Rarely does the twain meet on common
ground. The bean counters on one side speak in terms of ledger entries, and bit-
heads on the other side speak in techno terms of databases. Although they speak of
the same thing and the seeds of agreement are plentiful, both sides often walk away
frustrated because they cannot find the common ground. IA 2 is a tool that will help
find this common ground by aligning security solutions (often technical, but not
always) with business drivers.
Discovering this common ground begins with first distinguishing business
from technical, and then linking or aligning the two. A business function may be
accounting . A service within accounting may be expense reimbursements; another
service may be accounts receivable. Each of these business functions and services
is a collection of systems. The expense reimbursement service may consist of an
automated system that accepts employee input and a manual system that reconciles
employee claims against credit card receipts. This is the first link between business
talk and techno-talk; that is, the enterprise consists of business functions that in
turn consist of one or more systems, some of which are technical. The Enterprise
Context Framework (ECF) (see chapter 12) aligns enterprise business functions
with the components and subcomponents of systems, and to tasks in workflows.

11.3 organizational Structure Context Framework

Organizations distinguish among people who decide what to do ; those who acquire,
compile, and direct the right people in what to do; and those people who do . This

Service-oriented architecture (SOA).