One Approach to Enterprise Security Architecture

This paper discusses an approach to Enterprise Security Architecture, including a security policy, security domains, trust levels, tiered networks, and most importantly the relationships among them. Rather than discussing the infrastructure of an information security program, this paper focuses on the architecture of an information security program. So what's the difference? The infrastructure refers to the supporting elements needed for functionality, and the architecture refers to the cohesive design of the elements. While reading this paper, observe how the business objectives and management's security concerns are relayed to the users of corporate information via the enterprise security policy. Observe how the security domains inherit the policy, how the trust relationships are established between the security domains based on the policy, and how tiered networks are physically utilized to support the policy.