Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Had this question at Owasp Scotland this evening, and didn't get useful answers.

Is there too much specialisation in security now which means that enterprise architects can't know enough to delivery security as part of their day job?

share|improve this question

This question has an open bounty worth +50 reputation from Rory Alsop ending in 7 days.

This question has not received enough attention.

2 Answers 2

up vote 2 down vote accepted

My first observation is that security is everybody's responsibility. No one person is going to be able to police an entire organization's codebase. Security design and enterprise design are inherently different in purpose and goal, but the two should interact closely for best result. An enterprise architect's goal is to design a system that meets business needs and represents business processes accurately and come up with a consistent pattern for implementing such functionality. A security architects goal is to design a pattern of security and provide a consistent pattern for it's implementation and enforcement.

In a large environment, the mere scale of these two tasks might merit different people working on them and there could be a slight gain in relation to separation of responsibility between the business process and the security process, but in general I don't see any strong reason why someone with a cross over skill set couldn't do both. (I say this as an enterprise software architect with a background in security design.)

share|improve this answer

To post a contrary view to AJ's excellent answer:

At a large corporation, architecture may end up being the responsibility of multiple teams in different departments, countries, regions etc. in order to be performant for each region, whereas enterprise security is likely to be managed from a global perspective to reduce risk to the organisation as a whole.

So I tend to favour the idea of security architecture being a sub-discipline of either architecture or security, with practitioners working with enterprise architects in order to reach a best of both worlds (or compromise) solution.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.