SmartSuite for the Security Architect

Security. Holds the security standards and reference patterns and tracks architecture exceptions with owners, expiry dates and remediation roadmaps.

Change. Routes solution designs and significant changes through security review with findings recorded against the change.

Asset config. Uses the CMDB and asset register to scope reviews and map controls to systems.

Monitoring event. Links threat modeling outputs to the vulnerabilities and detections that monitor them.

Reporting. Reports review throughput, open exceptions and control coverage by system to the CISO.

What is a Security Architect accountable for?

The Security Architect is accountable for the security standards systems are built to: the architecture principles, patterns and reference designs, the review of solution designs, changes and vendors against them, the translation of framework and policy requirements into technical controls, threat modeling and architecture risk assessments, advice on identity, network, cloud and data protection design, and the register of architecture exceptions with their remediation roadmaps. They keep the standards current as threats and technologies change, which now includes post-quantum readiness.

How does SmartSuite help a Security Architect manage architecture exceptions?

SmartSuite holds the security standards and reference patterns and tracks architecture exceptions with owners, expiry dates and remediation roadmaps, so an exception granted to a project is a record with the person accountable, the date it lapses and the plan to remove it, rather than an email that is forgotten once the project ships. The Security Architect sees every open exception and which are approaching expiry. Control Framework & Regulatory Libraries holds the framework requirements the standards derive from.

How are solution designs and changes routed through security review?

Change Management routes solution designs and significant changes through security review with findings recorded against the change, so a design reaches the Security Architect as a review task and the findings, conditions and approval are attached to the change the Change and Release Manager tracks. The Engineering Manager and DevOps Engineer see what was required before the change proceeds. Review throughput and what is waiting on security are visible, which is the usual complaint about architecture review answered.

How does this role map controls to systems and scope reviews?

Configuration Management (CMDB) and the asset register are used to scope reviews and map controls to systems, so when the Security Architect reviews a change or assesses a threat model, the systems in scope, their dependencies and the controls already applied are read from the CMDB. Control coverage by system then becomes a question with an answer: which systems meet the pattern, which carry exceptions and which have not been reviewed. The IT Compliance Manager works from the same mapping.

How does a Security Architect connect threat models to vulnerabilities and detections?

Cyber Threat Management captures the threats an architecture risk assessment identifies and links each to the vulnerabilities in Vulnerability Management that would realize it and to the incidents and controls that concern it, so a modeled threat is connected to the findings that matter. The Security Architect can show that a modeled threat is either mitigated by design, monitored or carried as an exception. Post Quantum Security (PQS) sits alongside, so the cryptographic transition is planned in the same place as the rest of the architecture roadmap.

How does a Security Architect report to the CISO and CTO?

SmartSuite reports review throughput, open exceptions and control coverage by system to the CISO, so the Security Architect's report to the Chief Information Security Officer and Chief Technology Officer shows how many reviews were completed and how long they took, which exceptions are open and expiring, and which systems meet the standards. The IT Risk Manager reads the exception list as a source of technical risk. The report is a view of the records, produced when it is asked for.

What does a Security Architect need to get the standards into SmartSuite?

The current standards and reference patterns, the list of known exceptions with their owners, the CMDB or asset register as it stands and the change process the review attaches to. Standards are loaded as the documents they already are; exceptions become records with expiry dates. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an architect the first workflow is the exception register, because that is where the unmanaged risk is, with reviews routed through Change Management once the Change and Release Manager agrees the trigger.