Modeling SABSA Security Architecture in ArchiMate with Archi

Name: Modeling SABSA Security Architecture in ArchiMate with Archi
Rating: 4.9 (6 reviews)

Using Archi / Protege / PlantUML / JSON Tools to Model SABSA® Security Architecture in ArchiMate® Specification

Created byXiaoqi Zhao

Last updated 4/2026

English

What you'll learn

The ArchiMate language specification and TOGAF methodology/framework
The SABSA methodology and matrix from different layers
Alignment between SABSA and ArchiMate from the joint modeling approach
Hands-on practice through Archi, Protege and other tools to modeling the Security Overlay

Course content

11 sections • 113 lectures • 28h 57m total length

Opening and Introduction24:33
Preface and Background22:48
ArchiMate Specification Intro and A Simple ArchiMate Diagram41:11

4.1 Introduction to the Security Overlay11:23
4.2 An Overview of the Task12:30
4.3 Risk & Security Modeling in ArchiMate - Figure 06: Risk-Modeling Example36:29
4.3 Risk & Security Modeling in ArchiMate - Figure 07: Risk-Modeling Relations20:43
4.3 Risk & Security Modeling in ArchiMate - Figure 08: Mapping of Risk/Security17:39
4.3 Risk & Security Modeling in ArchiMate - Figure 09: Motivation Metamodel14:07
4.4 The Basic Elements and Relationships4:59

5.0 Figure 10: Security Enhanced Motivation Metamodel20:29
5.1 Value & Loss - Figure 11: Modeling Assets using Value24:29
For PlantUML tool usage, check my Udemy course "Learning and Practicing PlantUML (UML Modeling Language) with Live Demo" for detail
5.1 Value & Loss - Table 10: Proposed Value Property Overlay12:53
5.2 Value Chain - Figure 12: Composition of Value Chain22:10
5.2 Value Chain - Table 11: Value Chain Properties11:58
5.3 SABSA Business Attrubute - Figure 13: Represented in ArchiMate Language16:21
5.3 SABSA Business Attribute - Table 12: SABSA Attribute Properties7:36
5.3 SABSA Business Attribute - 5.3.1 Structural Placement - Figure 1617:14
Figure 16: Principles in the ArchiMate Motivation Hierarchy
5.3 SABSA Business Attribute - 5.3.1 Structural Placement - Figure 1722:35
Highlighting the Control Hierarchy Mismatch (i)
5.3 SABSA Business Attribute - 5.3.1 Structural Placement - Figure 1812:02
Highlighting the Control Hierarchy Mismatch (ii)
5.3 SABSA Business Attribute - 5.3.1 Structural Placement - Figure 199:48
Figure 19: Achieving the Desired Hierarchy
5.3 SABSA Business Attribute - 5.3.2 Traceability of Business Attributes28:30
5.4 Meaning - Figure21: Applying Attribute Metrics to Multiple Controls9:39
5.4 Meaning - Figure22: Use Meaning to Externalize Context-Sensitive Metrics10:08
5.5 Impact, Threat, Vulnerability, and Risk - Table 13: Schema Build Up14:46
5.6 Controls - Figure 23: Expressing Composite Requirements11:59
5.6 Controls - Figure 24: Example of a Control Pattern10:58
5.7 Multi-Tiered Security - Table 14: Control Element Properties13:36
5.7 Multi-Tiered Security - Figure 25: Example of Multi-Tiered Security20:15
5.8 Regulations and Standards - Figure 27: The Structure Modeling20:03
5.8 Regulations and Standards - Table 15: Properties Schema8:05
5.9 Articles, Mandates, and Compliance Objectives - Figure 27: GDPR Article 712:59
5.9 Articles, Mandates, and Compliance Objectives - Table 16: Schema in JSON8:44
5.10 Control Mechanisms - Figure 28: Use Cases and Iconography for Control16:07
5.10 Control Mechanisms - Table 17: Control Properties4:01
5.11 Trust - Table 18: Trust Profile (JSON Schema)4:53

6.0 Overview - Table 19: SABSA Contextual Architecture (ontology update)15:13
6.0 Overview - Figure 29: Develop and Maintain Contextual Security Architecture24:36
6.0 Overview - Table 20: Contextual Elements in native ArchiMate11:31
6.1 Business Assets - 6.1.1 Figure 30: Value Stream Modeling15:51
6.1 Business Assets - 6.1.2 Table 22: Business Object Security Properties6:07
6.1 Business Assets - 6.1.2 Figure31: Element Properties and SABSA Attributes14:19
6.1 Business Assets - 6.1.3 Table23: Business Service(SLA)/Interface Properties14:14
6.2 Buiness Risk & 6.3 Business Process/Function/Interaction - Table 24 Schema10:25
6.4 Business Roles and Actors - Table 25: Properties Schema13:21
6.4 Business Roles and Actors - 6.4.1 Governance - Figure 32 RACI Relationships10:46
6.4 Business Roles and Actors - 6.4.1 Governance - Figure 3311:33
Figure33: Avoid RACI Entanglement
a) A Pattern Repeated in Multiple Views
b) ... Caused Entanglement in the Underlying Model
6.4 Business Roles and Actors - 6.4.1 Governance - Figure 3411:12
Figure 34: Recommended RACI Patterns
a) Solved by a Tertiary Relationship
b) Solved by Specialization of an Abstract Base Role
6.4 Business Roles and Actors - 6.4.1 Governance - Table 26: RACI Properties4:06
6.4 Business Roles and Actors - 6.4.2 Threat Actors - Figure 3515:37
Figure 35: Possibilities for Modeling Threat Actors
a) Something you are? (a throughly bad person)
b) Opportunist Exploit? (a trusted employee falls to temptation)
c) Something you do? (a wrong action)
6.4 Business Roles and Actors - 6.4.2 Threat Actors - Figure 3610:13
Figure 36: Sensitivity in the Representation of Threats
a) Avoid unnecessary offence
b) Acknowledge the risk without personalizing it
c) Avoid assigning motive
6.4 Business Roles and Actors - 6.4.2 Threat Actors - Table 273:32
6.5 Business Geography & 6.6 Business Time Dependencies & Section Recap7:23

7.0 Conceptual Security Architecture Overview - Table 2817:43
Table 28: SABSA Contceptual Architecture, documented in Protege Ontology editing tool
7.0 Conceptual Security Architecture Overview - Figure 3730:27
Figure 37: Developing the SABSA Conceptual Security Architecture
7.1 Attribute Profiling - Figure 38: Attribute Profiling (i)12:55
7.1 Attribute Profiling - Figure 39: Attribute Profiling (ii)10:22
7.1 Attribute Profiling - Figure 40: Attribute Profiling (iii)7:28
7.1 Attribute Profiling - Figure 41: Completed Attribute Profile13:11
7.2 Risk Management & Strategy - 7.2.1 Risk Management - Figure 4218:50
Figure 42; Business Risk Analysis Process
7.2 Risk Management & Strategy - 7.2.2 Policy Architecture - Figure 4315:48
Figure 43: Compliance Metamodel, built in Archi's sketch view
7.2 Risk Management & Strategy - 7.2.2 Policy Architecture - Figure 4420:01
Figure 44: An Example Compliance Model
7.2 Risk Management & Strategy - 7.2.3 Multi-Regulatory Compliance - Figure 4511:14
Figure 45: Control Consolidation
7.2 Risk Management & Strategy - 7.2.3 Multi-Regulatory Compliance - Figure 4610:41
Figure 46: Possible Duplicate Objectives, Coupled Through Attribute Profile
7.3 Conceptual Security Services - Figure 47: Security Services in Conceptual18:00
7.4 Identity and Trust - 7.4.1 Identity and Access Right - Figure 4815:16
Figure 48: What the Security Overlay Would Like to Express
7.4 Identity and Trust - 7.4.1 Identity and Access Right - Figure 496:17
Figure 49: What the ArchiMate Specification Supports
7.4 Identity and Trust - 7.4.1 Identity and Access Rigth - Table 296:43
Table 29: Elements used in Logical Access Management
7.4 Identity and Trust - 7.4.2 Roles and Responsibilities - Figure 5020:01
Figure 50: Modeling Identity and Role Concepts
7.4 Identity and Trust - 7.4.3 Trust - Figure 5113:31
Figure 51: Common Examples of Signals Crossing Domain Boundaries
7.4 Identity and Trust - 7.4.3 Trust - Figure 5215:14
Figure 52: Simply Trust Relationships using Flow
7.4 Identity and Trust - 7.4.3 Trust - Figure 535:12
Figure 53: Trust Attributes Associated with Inter-Domain Signals
7.4 Identity and Trust - 7.4.3 Trust - Table 306:38
Table 30: Elements and Relationships used in Trust Modeling
7.5 Domain Framework Model - Table 31: Security Domain Mapping6:05
7.6 Security Events - Table 32: Security Events Schema3:43

8.0 Logical Overview - Table 33: SABSA Logical Architecture (ontology)21:18
8.0 Logical Overview - Figure 54: Developing SABSA Logical Security Architecture26:53
8.1 Information Assets - 8.1.1 Application Components - Figure 5514:19
Figure 55: A better solution using Architectural Models to identify Critical Applications
8.1 Information Assets - 8.1.1 Application Components - Table 345:41
Table 34: Application Component Properties
8.1 Information Assets - 8.1.1 Application Components - Table 3511:35
Table 35: Data Object Properties Schema, including «Defect», «Security Configuration», «Malware», and Data Object
8.2 Risk Modeling - Figure 56: Open FAIR™ Example Scenario18:30
8.2 Risk Modeling - Figure 57: The Open FAIR™ Risk Taxonomy (PlantUML)14:12
8.2 Risk Modeling - Figure 58: The Open FAIR™ Risk Taxonomy Modeled in ArchiMate19:41
8.2 Risk Modeling - Figure 59: The Open FAIR Risk Taxonomy Modeled (Qualitative)14:04
8.2 Risk Modeling - Figure 60: The Open FAIR Risk Taxonomy Modeled(Quantitative)7:57
8.3 Application Functionality and Services - Figure 61: Application Services18:09
8.3 Application Functionality and Services - Table 36: schema modeling9:00
Table 36: Application Behavior Availability Properties
8.4 Logical Access Management (LAM) - Figure 6216:57
Figure 62: Modeling Authentication in the Primary Architecture
8.4 Logical Access Management (LAM) - Figure 6322:22
Figure 63: Example of Registration and Provisioning in Secondary Architecture
8.4 Logical Access Management (LAM) - Table 3716:04
Table 37: Security Properties of Elements used in the Logical Layer
8.5 Logical Domains & 8.6 Timing and Events & Section Recap5:42

9.0 Physical Overview - Figure 38: SABSA Physical Architecture (Protege)13:31
9.0 Physical Overview - Figure 3: SABSA Component Architecture (Protege)18:19
9.0 Physical Overview - Figure 64: Developing SABSA Physical Sec. Architecture21:19
9.1 Data and Technology Assets - 9.1.1 Artifacts (Stereotypes)8:42
Figure 65: Stereotype of Artifact
9.1 Deat and Technology Assets - 9.1.1 Artefact - Figure 6612:37
Figure 66: Configuration Files
9.1 Data and Technology Assets - 9.1.2 Device & Node - Figure 6710:30
9.2 Risk Management Practices - 9.2.1 Defect - Figure 6839:21
9.3 Process Mechanisms - Figure 69: Realization of Security Services23:59
9.3 Process Mechanims & 9.4 Human-Machine Interfaces - Table 40 Schema (1)15:42
Schema documented via JSON on:
Technology Service
Technology Process / Technology Function
System Software
Technology Interface
9.5 Physical Env. & 9.6 Timing and Interrupts - Table 40 Schema (2)12:57
Schema documented via JSON on:
«Executable»
«Data»
«Defect»

Requirements

Certain knowledge on SABSA and Open Group's ArchiMate would be beneficial

Description

SABSA® (Sherwood Applied Business Security Architecture) is a methodology for developing risk-driven enterprise information security and information assurance architectures and for delivering security infrastructure solutions that support critical business initiatives. It is an open standard, comprising a number of frameworks, models, methods and processes, free for use by all, with no licensing required for end-user organizations who make use of the standard in developing and implementing architectures and solutions. (Source: W100 - SABSA® White Paper)

Are you a security architect looking to make the SABSA framework more tangible? Or an enterprise architect needing to integrate a robust security overlay into your ArchiMate models? This course transforms the theoretical "Sherwood Applied Business Security Architecture" (SABSA) into a visual, actionable practice using the industry-standard ArchiMate language and the open-source Archi tool.

Why this course? SABSA is renowned for its business-driven logic, but creating its numerous artifacts at scale can be challenging. By leveraging ArchiMate’s extensibility, you will learn to build a "Security Overlay" that ensures traceability from business goals down to physical controls.

What You Will Learn:

The Rationale for Alignment: Why combining SABSA and ArchiMate is the "gold standard" for modern secure EA.
The Motivation Aspect: Modeling business drivers and security attributes using ArchiMate’s Motivation extension.
Layer-by-Layer Modeling: A step-by-step journey through Contextual, Conceptual, Logical, and Physical security architectures.
Tooling Excellence: How to use Archi (and advanced tools like jArchi scripts, PlantUML, and JSON) to automate and validate your models.
Practical Case Studies: Hands-on practice following patterns from the official "Guide to Modeling SABSA with the ArchiMate Specification."

Who is this for?

Security Architects wanting to move beyond spreadsheets and into model-based engineering.
Enterprise Architects (TOGAF/ArchiMate certified) looking to specialize in security.
Consultants who need to demonstrate compliance and risk management visually to stakeholders.

Through learning the Security Overlay modeling, you'll get chance to practice Archi, JSON, Protege, as well as FreePlane, enjoy!

Who this course is for:

Enterprise Architect or Security Architect who want to find the hands-on method of modeling Security Overlay
Any architects who want to enrich security modeling skills base on ArchiMate language specification

Modeling SABSA Security Architecture in ArchiMate with Archi

What you'll learn

Explore related topics

Course content

01 Preface and Introduction3 lectures • 1hr 29min

02 Rationale for the Alignment of SABSA and ArchiMate2 lectures • 20min

03 An Introduction to the ArchiMate Language5 lectures • 1hr 37min

04 Aligning the SABSA and ArchiMate Frameworks7 lectures • 1hr 58min

05 The Motivation Aspect26 lectures • 6hr 12min

06 Modeling the Contextual Security Architecture17 lectures • 3hr 20min

07 Modeling the Conceptual Security Architecture22 lectures • 4hr 45min

08 Modeling the Logical Security Architecture16 lectures • 4hr 2min

09 Modeling the Physical Security Architecture10 lectures • 2hr 57min

10 Conclusion and Summary1 lecture • 17min

Requirements

Description

Who this course is for: