Get complimentary access to the latest Gartner® SAM & FinOps Research report.


ITAM’s Essential Role in Security

Data breaches are predicted to cost the global economy 10.5 trillion dollars by 2025. But the results are already in. Cybersecurity has never been higher on the agendas of companies and governments for whom a big breach could spell ultimate disaster. In recent years, many high-profile hacks have hit the headlines; Equifax had 145 million account details stolen in 2017, Uber lost 57 million records in a breach, and Marriott nearly 500 million. But while these breaches may have garnered media attention, cybersecurity is a pressing concern for every company and significant breaches are happening every day. 

Today we’re looking at the biggest risks in cybersecurity, their costs, and how greater cooperation between security and ITAM teams can help to avoid them. 

If you examine each of these cases, it’s often mistakes in IT management that played a contributing factor. In the case of Equifax, the US Senate (the price tag of breaches means even governments are getting concerned) found that it was a lack of a comprehensive IT asset inventory process that prevented them from meeting their patch management policies. For example, competitors who were also targeted were able to avoid the breach by identifying vulnerable versions of the software and proactively managing their patches. 

The SolarWinds hack was one of the most impactful breaches of the 21st century because of the knock-on effects it had through the company’s supply chain. In fact, it was through the company’s own IT performance monitoring system, Orion, that the malware was spread to nearly 30,000 public and private customers. Hackers then used the opportunity to install more malware that helped them spy on these organizations. The hack affected some of the largest companies in the world including, Microsoft, Intel, Cisco, VMware, FireEye, and various US government organizations. 

We used to talk about ‘security’ within a company but these days we’re almost always talking about secure technology. So how can we have a strong security team if we aren’t working with the team managing our technology? Likewise, how can ITAM afford to ignore security when they are dealing with such enormous risk?  

It’s clear that it’s time for ITAM and security to join forces. Gartner predicts that by 2022, “50% of ITAM initiatives will be primarily driven by IT security needs and concerns” and that this overlap is a natural progression because “about 50% of the requirements for ISO 19770-1 (ITAM compliance) overlap with ISO 27001 (cybersecurity compliance).”  

In addition, the PCI Data Security Standard is primarily focused on security needs, but there are components of SAM involved within the requirements as well. 

  • PCI – DSS 2 v3.2 requires organizations to maintain a list of all hardware and software components with description of function/use of each. 
  • PCI – DSS 5 v3.2 requires organizations to protect all systems against malware and regularly update anti-virus software or programs. 
  • PCI – DSS 6 v.3.2 requires organizations to ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.   

    So how can these two teams benefit one another? First, IT asset management can help organizations create a comprehensive inventory of hardware and software components that will help protect them from viruses and malware by keeping software patched and regularly updated. Out-of-date software is one of the five greatest contributors to data breaches and hacks.

    ITAM and cybersecurity working together can systematically manage asset inventory, asset ownership, information classification, asset handling, and removal of media. Processes like patch management will be infinitely easier with these two teams collaborating as they jointly identify vulnerabilities, develop, test, deploy, scan, and assess patches.

    Combating shadow IT is another great outcome of this collaboration. Together, ITAM and Security teams can remove rogue devices, limit risky software, and prevent unauthorized installations that are rapidly cropping up with the growth of SaaS products.

    It’s time for ITAM and Security to start talking. Siloed teams and limited visibility on both sides are leading to massive security gaps and redundant efforts, and security processes are critical for a successful SAM program. And with hackers only getting smarter, there’s no room, or budget, for waste.

    For more information on how you can better align your ITAM strategy with IT security, see our security services.

    Would you like to learn more about how we help with IT Security & GRC

    Related Resources

    Let’s start a conversation.