TechnologyThe ProfessorIntermediate
SABSA: Business-Driven Security Architecture course icon

SABSA: Business-Driven Security Architecture

Like Duolingo, but for SABSA: Business-Driven Security Architecture. Tomo turns the whole topic into a game you play five minutes a day, until it actually sticks.

For the part of you with thirty open tabs that never became anything.

12 bite-size levelsAbout 5 minutes each

Free forever · No credit card · iPhone & Android

Sherlock the Security Shrew
SABSA: Business-Driven Security Architecture
with Sherlock the Security Shrew
12
Levels
2
Sections
5
Min/day
What you'll learn

Key ideas in SABSA: Business-Driven Security Architecture

  • Attributes act as the 'DNA' that bridges the gap between the Business View and the Architect's View
  • Every attribute must have a specific metric to define how success is measured
  • The translation process turns qualitative business desires into quantitative security constraints
  • A target range or 'threshold' is required to determine if the architecture is performing as intended
  • The requirement for metrics and target ranges in architectural validity
  • The SABSA Taxonomy provides a pre-defined set of categories to ensure consistent definitions
  • Standardized terms prevent 'lost in translation' errors between technical teams and executives
  • How attributes translate vague business goals into technical security targets
  • Mapping attributes to stakeholders for accountability
  • The owner is the one who ultimately signs off on the target ranges and accepts the residual risk
  • Using the SABSA Taxonomy to standardize language between business and security
  • Proxy metrics use observable technical signals to represent abstract or subjective business concepts
  • Abstract attributes like 'Reputation' require indirect data points to become measurable in the SABSA framework
  • Using proxy metrics for abstract attributes
  • Vertical traceability maps technical components up to Business Attributes
  • Horizontal traceability checks consistency across the six SABSA domains
Why not just Google it

You've tried the other tabs

Wikipedia

Thirty open tabs. Four facts you actually kept.

YouTube

You watched. You nodded. By Sunday it was gone.

ChatGPT

One answer, then back to scrolling.

Online courses

Eight weeks. You meant to finish. You didn't.

Tomo gives SABSA: Business-Driven Security Architecture the Duolingo treatment: levels, streaks, and quick quizzes that test what you just learned. That game loop is what the tabs above never had, so it's the one you actually finish.

Try a question

Here's what playing it feels like

A real question from this course. Take your best guess.

Bridging Business and Architecture

What must be assigned to a SABSA attribute to ensure its success can be objectively measured?

Get it right to open this lesson and 11 more in the app.

Course map

Where SABSA: Business-Driven Security Architecture takes you

Bridge the gap between business goals and technical security controls using the world's most successful enterprise security framework.

  1. 1

    Designing for Business Value

    • The Business Attributes Profile
    • Applying Two-Way Traceability
  2. 2

    Operationalizing the Framework

    • Risk as a Business Enabler
    • Navigating the 6x6 Matrix

2 sections · 4 units · 12 levels. Built to play, not to enroll.

How it's taught

You pick the voice

This course
The Professor

SABSA: Business-Driven Security Architecture is taught in the The Professor style: clear, structured, thorough. Want a different feel? In the app you can spin up the same topic in any of Tomo's teaching styles. Same facts, totally different vibe.

Start free

Start SABSA: Business-Driven Security Architecture today.

Download Tomo, search SABSA: Business-Driven Security Architecture, and play your first lesson in under a minute.