Security architecture for the enterprise platform of an electricity transmission operator

Situation

An electricity transmission system operator, part of the critical infrastructure sector, is developing an enterprise platform. Its platform and security architecture management wanted security built into the platform architecture while development was under way, and the group’s internal policies reflected in it from the start. Architecture, product management, risk management and DevOps all had to work from the same requirements.

Approach

For four months, WCS advised the platform and security architecture management.

• Current state: analysis of how far the platform’s development had progressed.
• Principles and access: guiding principles for the security architecture and access controls for the platform, with secure design principles such as defence in depth, least privilege and secure default configurations applied across the lifecycle.
• Integration: identification of critical integration points and secure integration patterns between platform services and external systems.
• Controls: security and compliance controls from the group’s internal policies translated into architecture decisions, and reviews of architecture blueprints.
• Processes and training: workshops and training on security best practices, and process guidelines for security reviews and incident management.

WCS also advised the Chief Risk Officer, product management and DevOps on governance and risk management.

Result

The platform has documented security principles and access controls that architecture, product, risk management and DevOps work from. Requirements from the group’s internal policies appear as concrete architecture decisions, and the blueprints were reviewed against them. Critical integration points are known and covered by defined integration patterns. Security reviews and incident management follow written process guidelines, and the teams involved have been trained on the same security practices.