What is modern defensible architecture?
Modern defensible architecture is the first step in Australian Signals Directorate (ASD)’s Australian Cyber Security Centre (ACSC)’s push to ensure that secure architecture and design are being considered and applied by organisations in their cybersecurity and resilience planning. It is an approach that assists organisations in applying consistent, foundational goals to build, maintain, update and enhance their systems.
Modern defensible architecture aims to assist organisations to prepare and plan for the adoption of technologies based on:
- Zero trust principles of “never trust, always verify”, "assume breach" and "verify explicitly", implemented through zero trust architecture; and
- Secure by Design practices to institute a security mindset within organisations when it comes to procuring or developing software products and services.
What is zero trust?
Zero trust is a cybersecurity approach that removes the concept of inherent trust from resources and users inside a network perimeter and ensures that every request is verified before access is granted. Access policies use contextual information based on real-time and accurate data about the requestor, environment and resources, assuming the network is hostile until proven otherwise.
Zero trust architecture combines security concepts and capabilities designed and built into an architectural approach that implements zero trust principles.
What are the Foundations for modern defensible architecture
ASD’s ACSC’s Foundations for modern defensible architecture (the Foundations) provide a baseline of secure design and architecture activities that will best prepare organisations to adapt to current and emerging cyberthreats and challenges. The Foundations have been developed to assist organisations to prepare and plan for the adoption of technologies based on zero trust principles and architecture and Secure by Design practices.
The Foundations provide an additional layer of architectural advice to support complementary cybersecurity outcomes to ASD’s Essential Eight and Information security manual (ISM).
Feedback
The Foundations have been released for consultation to allow organisations across the private and public sectors to provide feedback and contribute to the Foundations to ensure they are clear, relevant and useful. Throughout March and April we undertook a series of consultative roundtable discussions and received written feedback via email. We are currently reviewing the extensive feedback and comments received to inform updates to the Foundations and future publications. In the meantime, we still welcome written feedback or questions via our email address at acsc.sda@asd.gov.au