Wikipedia

Draft:Enterprise Security Architecture for Reliable ICT Services

  • Comment: Thanks for your submission! Unfortunately, the issues brought up in previous reviews have not been adequately fixed yet. There is a lot of reliance on sources written by von Faber, which are not acceptable for assessments of notability as they are not independent of the subject. Most of the other sources don't mention ESARIS by name, making the citations difficult to verify, and they probably toe the line of original research by the fact that they've been included at all. I'll also add that the prose is extremely vague; take this example from the lead: "ESARIS is a holistically structured, architectural approach for larger IT service providers...". Okay, while that is well and good, the sentence does not actually convey any real information about what the method is, it's just relatively subjective-sounding descriptors without much encyclopedic substance. There are several other examples throughout the draft. Let me know if you have any questions about this! —TechnoSquirrel69 (sigh) 22:01, 24 November 2023 (UTC)

Enterprise Security Architecture for Reliable ICT Services (ESARIS) is a set of methodologies, processes, practices, and IT security standards to adequately secure IT services.[1][2] ESARIS follows a similar approach to ITIL and ISO/IEC 20000 regarding quality issues in IT service provisioning in that it defines work areas and breaks them down into individual process activities, but ESARIS reuses the work areas and processes from ISO/IEC 20000 and details them for IT security instead of defining a separate process model for it. The ESARIS methodology has been adopted by T-Systems as a basis for their security best practices and IT security framework.[3][4][5] The Federal Ministry of Defence of Germany recommends ESARIS as an exemplary industry standard.[6]

ESARIS was designed by Eberhard von Faber on behalf of and working for T-Systems and as part of his work as professor of IT security. The design of ESARIS took place between 2010[7] and 2016[1] and improved up to 2023.[8]

Short profile edit

ESARIS helps organizing IT security throughout the entire supply chain.[9] ESARIS covers the whole provisioning process from portfolio and offering design and implementation all the way down to the different aspects of maintenance in the operational phase. ESARIS builds upon existing processes of IT service management (ISO/IEC 20000 or ITIL), additionally considering internal organization specifics, focusing on the exact technical implementation of security and compliance with security related standards.[1] ESARIS supports communication and cooperation between the parties and emphasises the necessity for contractual agreements on IT security.[10]

ESARIS uses hierarchy and taxonomy to structure and organize[11] security standards, organizational, technical, and procedural security measures as well as guidelines, work instructions, etc. The latter assist employees in guaranteeing the necessary level of IT service security.[1]

Parts of ESARIS are adopted by the industry association Zero Outage Industry Standard and published as a standard.[12][13]

References edit

  1. ^ a b c d von Faber, Eberhard; Behnsen, Wolfgang (2017). Secure ICT Service Provisioning for Cloud, Mobile and Beyond (ESARIS: The Answer to the Demands of Industrialized IT Production Balancing Between Buyers and Providers) (2nd ed.). Wiesbaden: Springer Vieweg. doi:10.1007/978-3-658-16482-9. ISBN 978-3-658-16481-2. S2CID 33265004.
  2. ^ Steinacker, Angelika (2019). Sicherheit im Internet der Dinge (IoT), Ein sicheres IoT erfordert neue Denkweisen; Datenschutz und Datensicherheit 43, 403-409. doi:10.1007/s11623-019-1135-1. S2CID 255349646.
  3. ^ "DB Netz AG: Sicherheits-Fundament für die Zukunft".
  4. ^ AG, Deutsche Telekom (February 2, 2016). "Experton: Deutsche Telekom is a leading security-services provider". www.telekom.com.
  5. ^ "Architektur für die Sicherheit". www.report.at.
  6. ^ https://www.bmvg.de/resource/blob/140202/5f48d9a452805e7c3f2e61395682d7a9/ideenpapier-vertrauenswuerdige-it-data.pdf
  7. ^ von Faber, Eberhard; Behnsen, Wolfgang (2012). A Systematic Holistic Approach for Providers to Deliver Secure ICT Services; in: ISSE 2012 Securing Electronic Business Processes, Highlights of the Information Security Solutions Europe, ISSE 2012. Wiesbaden: Springer Vieweg. pp. 80–88. doi:10.1007/978-3-658-00333-3_9. ISBN 978-3-658-00332-6. Accepted by the program committee and presented at ISSE 2012: https://www.teletrust.de/veranstaltungen/isse/isse-2012/
  8. ^ von Faber, Eberhard (2023). IT-Service-Security in Begriffen und Zusammenhängen, Managementmethoden und Rezepte für Anwender und IT-Dienstleister. Wiesbaden: Springer-Verlag. ISBN 978-3-658-41932-5.
  9. ^ Damm, F., Fischer, HP. Lieferkette: Wie Cyber-Security von adäquater Zusammenarbeit abhängt; Datenschutz und Datensicherheit 43, 418–425 (2019). https://doi.org/10.1007/s11623-019-1137-z
  10. ^ Frére, Eric; Zureck, Alexander; Röhrig, Katharina (July 31, 2018). Industry 4.0 in Germany - The Obstacles Regarding Smart Production in the Manufacturing Industry. p. 38.
  11. ^ Cite error: The named reference VESNA was invoked but never defined (see the help page).
  12. ^ "Introduction and Overall Picture".
  13. ^ "Security Taxonomy for IoT".

External links edit

Retrieved from "https://en.wikipedia.org/w/index.php?title=Draft:Enterprise_Security_Architecture_for_Reliable_ICT_Services&oldid=1192065444"