Why does cyber security architecture need its own way of representing systems, and what must that representation achieve?

Because there is no standardised notation for architecture plans in IT as there is in construction, and software-development notations are usually too detailed; a CSA representation must let people analyse, evaluate and decide, by showing only the security-relevant aspects of a system in a model.

The options compared:

• Construction industry: normed notation for architectural plans. Nothing comparable exists in IT.
• Software development: notations meant for turning designs into code (such as detailed UML), generally too detailed for CSA.

The task of CSA is to help people analyse, evaluate and decide, to support them in building and operating sensible security constructions, and to allow safe interaction with cyber systems. A good way to make complex relationships understandable is to describe the important things in a suitable model. A CSA model therefore does not describe every aspect of a cyber system, only those that matter for security, using a simple system notation that is extended as needed.