3. Logical Architecture: Designer's View

Logical Security Architecture 

The logical security architecture develops more detail to flesh out the bones of the conceptual framework that you have developed at the second layer of the security architecture model. The logical layer is largely concerned with the functional view of security, defining a comprehensive set of functional requirements. It does not at this stage pay attention to the security mechanisms that will be used to deliver those functions – these are part of the physical security architecture at the

next layer down.

Business information is the logical representation of the real business. Hence the information assets needing protection are secondary assets that logically represent the true primary assets – the business itself.

The overall logical representation of the business is through the information architecture, which must pre-exist the development of the logical security architecture. This information architecture should distinguish between knowledge (conceptual layer), information (logical layer) and data (physical layer).

The logical representation of the business requirements for information security is expressed through security policy. Security policies are high-level statements of what sort of security and how much security is needed, but they do not state how that security is to be delivered.

Security policy is implemented through a series of security services. These security services are logical services – specified independently of what physical mechanism might be used to deliver them. They are driven from the conceptual security architecture layer above, most specifically from the Business Attributes Profile, the control objectives and the security strategies.