I created and delivered this presentation as a speaker at the 2005 Information Technology Asset Management Annual Conference

1. <Category>
<Track>
The Role of ITAM in Information Security
Presented by
Steve Gerick CISA, CISM, CITAM, PMP
Associate Director - Protiviti

2. <Category>
<Track>
Industry Trends & Drivers
 People
 Mergers and Acquisitions
 Regulatory Compliance
 Reduction of Organizational Silos
 Centralized Model (consolidation and standardization)
 Technology
 Increased computing complexity
 Need for “Active Asset Management”
 Electronic software distribution & Patch Management
 Move to suites instead of point products
 Vendor Consolidation
 Process
 Real-time process model
 Interest in ITIL and CobiT
 Driven more by compliance needs

3. <Category>
<Track>
Top Five IT Issues*
 Strategic Alignment
 Need to align IT with the business and its goals - providing a flexible,
integrated information infrastructure to support business strategy.
 Value Delivery
 Places the focus on expenses and proof of value and concerns itself
with cost-optimization, with ensuring a favorable return on investment
for IT and a positive bottom-line impact.
 IT Assets
 Targets knowledge and infrastructure. Deals with the selective
outsourcing of non-core processes to trusted suppliers, to leverage
knowledge and skills internally and externally
 Risk Management
 Concerns itself with safeguarding assets and preparing for disaster.
 Performance Measurement
 Necessary for any of the other four to be managed appropriately in a
complex economic and geopolitical environment. ISACA Journal Volume 4, 2002
Erik Guldentops - ITGI

4. <Category>
<Track>
Typical ITAM Lifecycle

5. <Category>
<Track>
IT Security Management Lifecycle
* NIST Guide to Information
Technology Security Services

6. <Category>
<Track>
ITAM & Infosec Linkages
 Configuration Management
 Patch Management
 Vulnerability Management
 Data Protection
 Property Accounting
 Active – Inactive Assets
 Asset Disposal
 Theft Prevention
 Move to suites instead of point products
 Compliance
 Software License Compliance
 SOX, GLBA, HIPAA, Basel
 Software Piracy

7. <Category>
<Track>
ITAM & The ITIL Framework
Planning to Implement Service Management
T T
h h
Service Management
e e
ICT
The Business Service T
B Infrastructure
Support e
u Perspective Management
s c
i h
n n
Service o
e
Delivery Security l
s
s Management o
g
y
Application Management
Suppliers
* ITIL Best Practices Services
Software Asset Management

8. <Category>
<Track>
Relationship between ITAM & Security
Overall Management
Overall management Processes
Competence, awareness and training
responsibility Performance metrics and continuous improvement
Risk assessment Service continuity and availability management
Policies and procedures
Core Asset Management
Asset identification Processes management
Database
Asset control Financial management
Status accounting
Logistics Verification and Relationship
Processes Compliance Processes Processes
Requirements definition (Governance) Contract management
Design Supplier management
Evaluation Verification and audit
License compliance Internal business relationship
Procurement management
Build Security compliance
Other compliance (software standards) Outsourcing management
Deployment
Operation
Optimization
* ITIL Best Practices Services
Retirement
Software Asset Management