Competences of IT Architects

The field of architecture in the digital world uses a plethora of terms to refer to different kinds of architects, and recognises a confusing variety of competences that these architects are required to have. Different service providers use different terms for similar architects and even if they use the same term, they may mean something different. This makes it hard for customers to know what competences an architect can be expected to have.\ud \ud This book combines competence profiles of the NGI Platform for IT Professionals, The Open Group Architecture Framework (TOGAF), as well as a number of Dutch IT service providers in a comprehensive framework. Using this framework, the book shows that notwithstanding a large variety in terminology, there is convergence towards a common set of competence profiles. In other words, when looking beyond terminological differences by using the framework, one sees that organizations recognize similar types of architects, and that similar architects in different organisations have similar competence profiles. The framework presented in this book thus provides an instrument to position architecture services as offered by IT service providers and as used by their customers.\ud \ud The framework and the competence profiles presented in this book are the main results of the special interest group “Professionalisation” of the Netherlands Architecture Forum for the Digital World (NAF). Members of this group, as well as students of the universities of Twente and Nijmegen have contributed to the research on which this book is based

Improving IT infrastructures representation: A UML profile

IT infrastructures are most times informally modeled. The resulting models are ambiguous to stakeholders, cannot be checked for validity, and therefore are unable to play their important role in design, deployment and maintenance activities. The main reason for such a poor state-of-the-art lies mainly in the absence of a modeling language capable of representing IT infrastructures at the required level of abstraction. Indeed, existing candidate languages are too abstract, as shown in this paper by reviewing their metamodels. The present paper mitigates this problem by proposing a UML profile to describe the semantics of an IT infrastructure.info:eu-repo/semantics/publishedVersio

A Comparison of Security Risk Analysis in the In-house IT Infrastructure and Cloud Infrastructure for the Payment Gateway System

Infrastruktuuri lahendused viiakse pilve tänu paremale juhtimisvõimekusele, seadmete tehnilisele arengule ning pilve lahenduste paindlikkusele ja kuluefektiivsetele võimalustele. Seetõttu muutub ettevõtte arhitektuur, kui süsteemid viiakse uude infrastruktuuri. Selliste muutuste tõttu võivad turvariskid suureneda või väheneda, avalduda uued riskid või suudetakse kõrvaldada mõned olemasolevad riskid. Ainult äriprotsesside modelleerimisele tugineva riskianalüüsi puhul, kus tuvastatakse ettevõtte varade väärtus, puudub IT-infrastruktuuri ja äriprotsesside omavahelise seose esindamine. Seega võib riskianalüüsis teatud infosüsteemi (IS) varasid hoopis eirata. Kahe infrastruktuuri turvariskide analüüsimisel tuleb arvestada ettevõtte arhitektuurilisi erinevusi, sest identifitseerimata IS varad võivad olla haavatavad ja kujutada ohtu käsitletavale organisatsioonile. Käesolevas töös tuvastatakse arhitektuuri modelleerimise kaudu varad, mis on vajalikud riskianalüüsi tegemiseks. Koostatud mudelid näitavad erinevusi, mis on seotud IS varadega organisatsiooni sisemise infrastruktuuri ja pilves vahel. Organisatsiooni arhitektuurist tulenevate IS varadega seotud turvariskide kindlaksmääramisel kasutatakse STRIDE taksonoomia põhist ohu modelleerimist.Selles uurimistöös esitletakse protseduuri, mis aitab organisatsioonidel tuvastada kahe infrastruktuuri IS varade muutusi ja mõista turvariskide erinevusi. Käesolevas uurimistöös kasutatud arhitektuuri modelleerimine illustreerib IS varade erinevusi ja näitab, kuidas äriprotsesse saab kaardistada tehnoloogia komponentidega. Seejärel võimaldab ohu modelleerimine struktuurselt määrata süsteemi ohtusid. Vastavad turvariskid kategoriseeritakse põhinedes uue infrastruktuuri olemasolule. Riskidega seotud muutused toovad esile ettevõtte sisemise infrastruktuuri ja pilve infrastruktuuri vahe. Selline lähenemisviis on kinnitatud ekspertide poolt. Käesolev uurimistöö põhineb juhtumiuuringul, mis käsitleb Põhja-Euroopas kasutatavat maksekanali süsteemi.In-house infrastructures are migrated to the cloud owing to the enhanced technical management capabilities, technical advancement as well as the flexibility and cost-effective options offered by the cloud. Moreover, an enterprise architecture changes when the sys-tems are moved into a different infrastructure. Due to such infrastructural changes, secu-rity risks can increase or decrease, while new risks can be introduced and some risks can be eliminated. Asset identification for risk analysis based only on business process mod-elling lacks the integration and representation of the interrelationship between IT infra-structure and business processes. Hence, certain information system (IS) assets can be neglected in the risk analysis. When analysing the security risk of two infrastructures, enterprise architectural differences need to be captured, since unidentified IS assets could be vulnerable and pose a security risk to the concerned organisation.In this thesis, assets are identified via architectural modelling to perform risk analysis. Furthermore, models present the differences pertaining to IS assets within in-house infra-structure and cloud infrastructure, in addition to the mapping to corresponding business processes. The STRIDE-based threat modelling is employed to determine the security risks concerning IS assets derived from enterprise architecture.To elaborate, this study will introduce a procedure that will help organisations identify IS asset changes of two different infrastructures and capture security risk changes. Moreover, architectural modelling applied in this research will illustrate the differences regard-ing IS assets and present the way in which business processes are mapped to technology components. Subsequently, a threat modelling method employed will provide a structural way to identify threats to the systems. The changes incorporated concerning the security risks will further present the security risk gap regarding in-house infrastructure and cloud infrastructure. Additionally, the validation of this approach is performed by domain experts. The enterprise architecture modelled in this thesis is based on a case study dealing with a payment gateway system used in North Europe

Improving IT infrastructures representation: A UML profile

IT infrastructures are most times informally modeled. The resulting models are ambiguous to stakeholders, cannot be checked for validity, and therefore are unable to play their important role in design, deployment and maintenance activities. The main reason for such a poor state-of-the-art lies mainly in the absence of a modeling language capable of representing IT infrastructures at the required level of abstraction. Indeed, existing candidate languages are too abstract, as shown in this paper by reviewing their metamodels. The present paper mitigates this problem by proposing a UML profile to describe the semantics of an IT infrastructure.info:eu-repo/semantics/publishedVersio

Combining goal-oriented and model-driven approaches to solve the Payment Problem Scenario

Motivated by the objective to provide an improved participation of business domain experts in the design of service-oriented integration solutions, we extend our previous work on using the COSMO methodology for service mediation by introducing a goal-oriented approach to requirements engineering. With this approach, business requirements including the motivations behind the mediation solution are better understood, specified, and aligned with their technical implementations. We use the Payment Problem Scenario of the SWS Challenge to illustrate the extension

Management of Security Risks in the Enterprise Architecture using ArchiMate and Mal-activities

Turvalisuse tase on ettevõtte üks peamisi elemente, mida tuleb organisatsioonis kontrollida. Kui ettevõtte äri arengut modelleeritakse on eesmärgiks katkematu ettevõtlus, aga tihti ei võeta sellega arvesse turvanõudeid. Selliselt on aga infosüsteemi kõrget turvalisuse taset väga raske säilitada. Selles dokumendis käsitletakse lähenemisviisi, mis parandab julgeoleku vastumeetmeid, et selleläbi aidata ettevõtte arhitektuuri turvalisemaks muuta. Ettevõtte arhitektuurimudeli ja turvariski juhtimise vaheliste soeste leidmine toimub läbi Infosüsteemi turvariskide juhtimise domeeni mudeli (ISSRM). Ettevõtte arhitektuuri modelleerimiseks on kasutatud ArchiMate modelleerimiskeelt. Paljudest riskide kirjeldamise keeltest on sobilikum mal-activity (pahatahtlikute tegevuste) diagrammid, sest see aitab julgeoleku riskide juhtimist kõige paremini visualiseerida. Struktureeritud joondus aitab ülalnimetatud keelte vahelisi seoseid näidata ning annab informatsiooni kõige haavatavamate punktide kohta süsteemis. Turvalisuse taseme säilitamine aitab ettevõttel äritegevust viia sõltumatuks infosüsteemist. Selle dokumendi tulemuseks on ArchiMate ja Mal-activity diagrammide vahelised seostetabelid ja reeglid. Nende kahe keele vaheliseks seoseks on ISSRM. Kirjeldatud lähenemise valideerimine on läbi viidud ühe näite põhjal, mis on võetud CoCoME juhtumiuuringust. Näite põhjal on loodud mitmeid illustreerivaid pilte valideerimise kohta. Kõige viimasena on kirjeldatud meetodiga saadud tulemust võrreldud Grandy et.al. (2013) poolt arendatud lähenemisega. Võtmesõnad: Infosüsteem, Infosüsteemi turvariskide juhtimine, ettevõtte arhitektuur, ettevõtte arhitektuuri mudel, julgeoleku vastumeetmed, turvariskide juhtimine, riskidele orjenteeritud modelleerimiskeeled, ArchiMate, mal-activity diagrammid.Security level of the enterprise is one of the main elements that should be taken under control in the organization. It is difficult to maintain high security level of Information System. Since development of enterprise architecture is targeted on continues business flow modeling, it sometimes does not take into account security requirements. The paper provides an approach to improve security countermeasures to contribute with secure Enterprise Architecture. Filling the gap between Enterprise Architecture model and Security Risk Management is done through Information System Security Risk Management domain model (ISSRM). To build the Enterprise Architecture model, ArchiMate modelling language is being used. Among different risk-oriented languages, selection was done in favor of Mal-activity diagrams, which help to provide visual concept of Security Risk Management. Structured alignment can show the mapping between aforementioned terms and provide the information about most vulnerable points of the system. The maintenance of security level will help to make business flow independent from the state of Information System. The outcome of this paper is an alignment tables and rules between ArchiMate and Mal-activity diagrams. The mapping link between these two languages is ISSRM. Validation of our approach is done on the example, which is taken from CoCoME case study. It is shown on number of illustrative pictures. After getting the results, there is a comparison of the output between presented method and approach developed by Grandry et.al. (2013). Keywords: Information System, Information System Security Risk Management, Enterprise Architecture, Enterprise Architecture model, security countermeasures, Security Risk Management, risk-oriented modelling languages, ArchiMate, Mal-activity diagrams

Linking Telecom Service High-level Abstract Models to Simulators based on Model Transformations: The IMS Case Study

Part 3: ManagementInternational audienceTelecommunication services are widespread and subject today to tensions on a competitive market. Telecommunication service design is more and more software oriented. To reduce time to market and cost of services, a service designer better need to simulate and evaluate his design earlier. The approach proposed in this paper is to reduce the abstraction gap between modeling and simulation phases using model transformation. But manual transformations are so far time consuming and error prone.As a trustworthy solution, model based techniques and associated transformations permit to systematically link service models with simulation phase before realization. We thus propose as a first contribution a meta-model dedicated to concepts of IP Multimedia Subsystem core network as a case study. Our meta-model constrains and defines such network entities to be used in the code generation, which is our second contribution. The implementation of a video conference service permits to illustrate our workbench

An integrated conceptual model for information system security risk management supported by enterprise architecture management

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model