Architecture for ensuring the security of modern IT infrastructure of the enterprise

Abstract

The methodical bases of designing the security architecture of the IT infrastructure of the enterprise are considered. The architecture of the security system provides the necessary level of IT assets protection by describing approaches to the organization and formation of requirements for personnel, processes and technologies. The task of IT security is to ensure the protection of valuable information and its availability to authorized users. The security architecture includes three components: the process of risk management discipline; network zoning; echelon protection. The first component is based on the discipline of risk management. The process consists of four successive steps: identification and valuation of IT assets; identification of security risks; security risk analysis; reducing security risks. The second component is echelon protection – we assume that countermeasures are created at five levels of IT infrastructure: physical access; networks; nodes; at the data level; at the application level. The third component is network zoning. IT infrastructure is logically divided into zones with different components and protection requirements – the private zone contains assets that are fully controlled; the public area contains assets with which external customers interact. The architecture of the IT infrastructure security defines the fundamental principles of building IT services and their relationship. Security services consist of: perimeter security services, certificate management services. The perimeter security service monitors the flow of network traffic between two network segments, and provides: protection of internal servers from network attacks; implementation of network zoning, access policies and network use; traffic monitoring and detection of malfunctions. The Certificate Management Service is responsible for managing the lifecycle of security certificates used in cryptographic information security and digital signature systems. The certificate service, in particular, ensures the use of: digital signature; smart cards for user authentication; secure mail; software authorization; use of IPSec protocol; use of an encrypted file system; use of SSL and TLS protocols at the enterprise. When developing an IT infrastructure security architecture, we highlight the following criteria for quality assessment: the relationship between architectures, manageability, performance, consolidation, interoperability, and standardization.