I'm writing a security architecture for the application I'm working with. I'm struggling in finding a framework to follow for this task. I can find a lot of frameworks like TOGAF and SABSA that works with enterprise security, but my task is more specific to an application. Have anyone worked with such a framework?

2 Answers 2


If you're looking for more specific application security architecture guidance, I'd be inclined to look at OWASP materials as they're more focused in this area.

Project like the OWASP Developer Guide, OWASP Application Security Verification Standard or OWASP Software Assurance Maturity Model could be of use in this context


SABSA works for Application Security Architecture as well. Start with need for application i.e. which Business process application will be supporting, Identify Business attribute from Process owners and do a risk assessment for those attributes that will give you formal control objectives or Security requirements relevant to the application you are working on. Later you can strategize how to fulfill these control objectives logically/technically.

  • 1
    This answer contains no point in my opinion, just empty assurance along the words "just do it". Can you add some points and quote the required materials? Apr 19 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .