Slaying SABSA: Practical Tips on Passing Your SABSA Foundation Level Exam
It was a big start to 2021 this year. Unlike most other years where I’d spend most of January filling up my social calendar and thinking about what I want to accomplish in the months to come, I was thrown straight into battle mode and faced with the challenge of taking on the SABSA Foundation certification.
In all honesty, though, this is exactly what I wanted. I put my hand up last year to be a part of a team with my colleagues to attend the week-long SABSA training course and sit the two written exams to become SABSA certified.
Before I go any further, here’s a summary of what SABSA is exactly. Here’s the textbook definition:
“SABSA® is a methodology for developing risk-driven enterprise information security and information assurance architectures and for delivering security infrastructure solutions that support critical business initiatives. It is an open standard, comprising a number of frameworks, models, methods and processes, free for use by all, with no licensing required for end-user organisations who make use of the standard in developing and implementing architectures and solutions.”
How I like to think about SABSA, in addition to the above, is that SABSA is a structured way of thinking that can be applied to almost any problem. However, the most common uses for the SABSA methodology involve some level of enterprise security architecture.
Unlike most other years, the SABSA training was delivered virtually this year due to the recent switch to virtual working that COVID-19 greatly sparked. At first, I had mixed feelings about how this training would go because I felt like the breadth of information that we needed to learn would be better absorbed if delivered in-person and interactive. However, despite essentially being on a zoom call for five days straight, the learning experience was actually quite good and surprisingly interactive, which made the overall experience enjoyable for the most part. I think the trainer played a big part in making the experience what it was, though, so, fortunately, the rest was up to me.
Some quick facts about the SABSA Foundation Level (SCF) certification:
You must attend a 5-day training course delivering the two foundation-level learning modules:
Module F1 - SABSA Security Strategy & Planning
Module F2 - SABSA Security Service Management & Design
You must pass two multiple-choice exams for modules F1 & F2.
Both exams consist of 48 multiple-choice questions.
You must score 75% or higher on both exams.
You are given one hour for each exam to be completed (two hours of total exam time).
How I studied and prepared for the SABSA exams:
To uphold the integrity of the SABSA certification, I won’t be going into the specific details of the key exam topics or any of the questions you will face on the exam.
The range of topics and breadth of knowledge covered in the five-day SABSA course is nothing short of intense, to say the least. There is a lot to cover, and with that in mind, I found it was crucial to take note of key exam topics being discussed along the way. During the course, the trainer will mention the specific sections you will need to focus on for the exam.
Below are the tools and materials I used for further preparation before sitting the exam.
Essential reading material:
SABSA White Paper
Enterprise Security Architecture - The “blue book”, published in 2005
Although the SABSA blue book is mentioned here, reading the entire thing is not really essential. This book is best used as a reference guide to compliment the SABSA white-paper.
Study Tools:
Miro (https://www.miro.com)
Miro is a free (with limited features/functionality) cloud-based tool for doing all kinds of creative stuff. Everything from project management, agile brainstorming to creating flowcharts and mind-maps. I used Miro to re-create the 36-cell SABSA matrix and test my memory of each cell's contents by filling in the blanks.
Side-note: You could also use Microsoft Excel or Google Sheets for creating a matrix, so use whatever application you find easiest.
Miro is also available as a desktop and mobile (iOS/Android) application.
Draw.io (https://app.diagrams.net/)
Draw.io is another free cloud-based tool, and as the name suggests, it is a diagramming tool. I like draw.io mainly because of its ease-of-use and flexible saving/export options. I used draw.io to create my own SABSA case-study artefacts and re-enforce my knowledge on those key topics.
Draw.io is also available as a desktop application.
Anki (https://apps.ankiweb.net)
Anki is a great study tool that you can use for spaced repetition and allows you to create your own flashcards to assist you in your studying. I used Anki to create my own deck of SABSA study cards which I have uploaded on my website here (see bottom of the page) to help anyone keen on pursuing the SABSA foundation certification.
GitHub (https://github.com)
GitHub is primarily a tool for software development and version control using Git. However, GitHub can also be used to store files and source code, which makes it an attractive tool for most developers and programmers today. I use GitHub mainly for preparing and storing my own study notes using the markdown text format. Feel free to head over to my GitHub and check out my study notes that I prepared for the SABSA certification here.
I hope the above information helps those interested in SABSA certification and looking to further their career by becoming a SABSA certified chartered security architect.
