ITAM’s Essential Role in Security

Data breaches are predicted to cost the global economy 10.5 trillion dollars by 2025. But the results are already in. Cybersecurity has never been higher on the agendas of companies and governments for whom a big breach could spell ultimate disaster. In recent years, many high-profile hacks have hit the headlines; Equifax had 145 million account details stolen in 2017, Uber lost 57 million records in a breach, and Marriott nearly 500 million. But while these breaches may have garnered media attention, cybersecurity is a pressing concern for every company and significant breaches are happening every day. 

Today we’re looking at the biggest risks in cybersecurity, their costs, and how greater cooperation between security and ITAM teams can help to avoid them. 

If you examine each of these cases, it’s often mistakes in IT management that played a contributing factor. In the case of Equifax, the US Senate (the price tag of breaches means even governments are getting concerned) found that it was a lack of a comprehensive IT asset inventory process that prevented them from meeting their patch management policies. For example, competitors who were also targeted were able to avoid the breach by identifying vulnerable versions of the software and proactively managing their patches. 

The SolarWinds hack was one of the most impactful breaches of the 21st century because of the knock-on effects it had through the company’s supply chain. In fact, it was through the company’s own IT performance monitoring system, Orion, that the malware was spread to nearly 30,000 public and private customers. Hackers then used the opportunity to install more malware that helped them spy on these organizations. The hack affected some of the largest companies in the world including, Microsoft, Intel, Cisco, VMware, FireEye, and various US government organizations. 

We used to talk about ‘security’ within a company but these days we’re almost always talking about secure technology. So how can we have a strong security team if we aren’t working with the team managing our technology? Likewise, how can ITAM afford to ignore security when they are dealing with such enormous risk?  

It’s clear that it’s time for ITAM and security to join forces. Gartner predicts that by 2022, “50% of ITAM initiatives will be primarily driven by IT security needs and concerns” and that this overlap is a natural progression because “about 50% of the requirements for ISO 19770-1 (ITAM compliance) overlap with ISO 27001 (cybersecurity compliance).”  

In addition, the PCI Data Security Standard is primarily focused on security needs, but there are components of SAM involved within the requirements as well. 

• PCI – DSS 2 v3.2 requires organizations to maintain a list of all hardware and software components with a description of function/use of each. 
• PCI – DSS 5 v3.2 requires organizations to protect all systems against malware and regularly update anti-virus software or programs. 
• PCI – DSS 6 v.3.2 requires organizations to ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.