Security Architect Lessons: Managing and Assessing

Originally published on Red Canary Blog
Read the full article: Managing and Assessing

Managing Security Teams

Clear Expectations

Set clear goals and success criteria:

• Define roles and responsibilities
• Establish performance metrics
• Communicate priorities
• Provide regular feedback

Empower Your Team

Give people autonomy to do their jobs:

• Trust but verify
• Remove blockers
• Provide resources
• Support professional development

Foster Collaboration

Break down silos:

• Cross-functional projects
• Knowledge sharing sessions
• Blameless post-mortems
• Team building

Assessing Security Posture

Continuous Assessment

Security assessment isn’t a point-in-time activity:

• Regular vulnerability scans
• Penetration testing
• Red team exercises
• Purple team collaborations

Measure Detection Coverage

Use frameworks like MITRE ATT&CK to:

• Map existing detections
• Identify coverage gaps
• Prioritize new detections
• Validate effectiveness

Test Your Defenses

Regularly validate that your controls work:

• Atomic Red Team for detection testing
• Tabletop exercises for procedures
• Incident simulations for response
• Disaster recovery drills

Assessment Frameworks

MITRE ATT&CK

Map your detections to the framework to identify gaps.

CIS Controls

Prioritize security controls based on effectiveness.

NIST CSF

Align security program with business objectives.

Practical Tips

Start Small

Don’t try to assess everything at once. Focus on:

• Critical assets first
• High-risk areas
• Quick wins
• Measurable improvements

Automate Assessment

Use tools to continuously assess:

• Vulnerability management platforms
• Configuration management
• Compliance scanning
• Security testing frameworks

---

Read the full article: Managing and Assessing