This paper describes a reference model, in UML, for (enterprise) IT security. This framework defines a logical approach to enterprise security, but more importantly provides a cohesive structure for the definition and implementation of security services. The complete framework is described, but with a focus on subjects, and protected objects and how access is controlled. Multiple layers of security are defined, building upon the “defence in depth” concept, augmented with “domain” and “zone” concepts and associated protections. The dynamic use of roles is described, a concept that along with “user self-service” provides a practical approach for the management and use of roles for access control.

An expanded version of this IT architecture pattern is here: IT Security Reference Model