Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Had this question at Owasp Scotland this evening, and didn't get useful answers.

Is there too much specialisation in security now which means that enterprise architects can't know enough to delivery security as part of their day job?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

My first observation is that security is everybody's responsibility. No one person is going to be able to police an entire organization's codebase. Security design and enterprise design are inherently different in purpose and goal, but the two should interact closely for best result. An enterprise architect's goal is to design a system that meets business needs and represents business processes accurately and come up with a consistent pattern for implementing such functionality. A security architects goal is to design a pattern of security and provide a consistent pattern for it's implementation and enforcement.

In a large environment, the mere scale of these two tasks might merit different people working on them and there could be a slight gain in relation to separation of responsibility between the business process and the security process, but in general I don't see any strong reason why someone with a cross over skill set couldn't do both. (I say this as an enterprise software architect with a background in security design.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.