Traditional network security was built around a pretty simple idea – protect the perimeter, and everything inside it could generally be trusted. Today’s organisations operate very differently, however. Cloud platforms, remote working, mobile devices, third-party suppliers, and an increasingly complex digital environment overall have made that traditional network perimeter far less defined.
This change has accelerated the adoption of Zero Trust security principles, and increased demand for security architectures that can support them properly. Frameworks like SABSA® provide a structured, business-driven approach to designing security architecture that also aligns tech with organisational objectives.
In this article, we’ll explore how Zero Trust and SABSA complement each other, and why this combination is becoming increasingly important for modern organisations.
Why the Traditional Perimeter No Longer Works
For many years, cyber security strategies focused on protecting the boundary between an organisation’s internal network and the outside world. Firewalls, VPNs, and network segmentation all played important roles in defending this perimeter.
While these controls do remain valuable, modern organisations rarely operate entirely within a clearly defined network. Employees work remotely, applications are hosted in the cloud, and data moves across multiple environments every day. This means trust can no longer be based simply on location, and being ‘inside the network’ no longer guarantees that a user, device, or application should automatically actually be trusted.
Zero Trust addresses this challenge by adopting a different approach. Rather than assuming trust based on network location, every request is continuously verified based on identity, context, and risk before access is granted. This reduces the likelihood that compromised accounts or devices can move freely through an organisation’s environment.
Where SABSA Fits In
While Zero Trust provides a set of security principles, organisations still need a structured methodology for designing and implementing an architecture that supports those principles. This is where SABSA becomes particularly valuable.
SABSA is a business-driven security architecture framework and methodology that helps organisations design, implement, and manage security in a way that supports business objectives, rather than simply adding technical controls. SABSA starts by identifying business goals, operational risks, and security requirements, before tracing those requirements through every layer to implementation and ongoing management.
The framework also integrates with established governance and management approaches, including ITIL, ISO 27001 series standards, and enterprise architecture frameworks. This allows organisations to develop security architectures that support wider business processes, instead of operating independently.
In practice, this entire business-first approach provides a strong foundation for implementing Zero Trust in both a structured and sustainable way.
Building Around Business Requirements
One of the key strengths of SABSA is its focus on traceability. Rather than introducing security controls in isolation, the framework links every architectural decision back to an identified business requirement. This helps ensure that security continues to support organisational priorities, while also remaining aligned with governance, compliance, and risk management objectives.
This philosophy aligns closely with that of Zero Trust. Implementing the likes of continuous verification and stronger identity controls is more than a technical exercise. These measures need to reflect the way an organisation operates, the risks it faces, and the value it is trying to protect.
By taking a structured architectural approach, organisations are better able to design security that is both consistent and adaptable. As business requirements evolve, the underlying security architecture can also evolve alongside them, without losing sight of the original objectives. This becomes increasingly important as organisations adopt cloud services, AI technologies, and more distributed operating models, all of which continually reshape the threat landscape.
Developing the Skills to Design Modern Security Architecture
As organisations move towards Zero Trust models, the demand for professionals capable of designing security architecture only continues to grow.
Technical knowledge remains important, but modern security architects also need to understand governance, risk management, business strategy, and how security supports organisational objectives. Developing these capabilities requires more than simply having familiarity with individual technologies.
The SABSA® Foundation course, offered by ALC Training, introduces participants to the SABSA framework and methodology. It covers areas including security strategy, business requirements, enterprise security architecture, service management, governance, and integrated security design. Participants learn how to develop business-driven security architectures that align security services with organisational goals, while also integrating with frameworks such as ITIL and COBIT.
As security architecture becomes increasingly distributed, designing for clear business needs rather than traditional network boundaries is crucial. Frameworks such as SABSA help professionals develop the architectural thinking needed to support Zero Trust principles, while also ensuring security continues to enable, rather than constrain, organisational success.