Ruslan Rakhmetov, Security Vision
IT Asset Management (ITAM) is a complex process that covers all aspects of working with an organisation's IT assets, from their acquisition to disposal. The systems that keep track of all assets allow to ensure such a process.
Let's look at how the system works, using a simpler example, such as organising order on a computer. Let's imagine a special system that helps us keep track of all programmes and games: it knows what is installed, when it was installed and where it is located. Then by organising this process we can:
- find out what programmes are installed on the computer;
- organise them into ‘shelves’ for easy use;
- find lost programmes and games;
- update them to get the most out of them;
- delete unnecessary objects to free up space, for example, for storing photos and videos.
Let's imagine another situation: you need to sort out the clutter on a spaceship that is littered with spare parts, tools and other things, and it's been a long time since anyone has been able to find what they need. Then the ITAM function can be performed by a special smart warehouse for all things: it knows where each item is and how it can be used. Then with the help of process organisation it is possible to:
- draw a map on which all storage locations are marked;
- easily find what you need;
- find lost spare parts;
- mark items that are no longer needed so that you can safely throw them away.
As another example, you can imagine a magic chest in which you can store all your jewellery to:
- recognise how many jewels are in it and what they are;
- remember when we bought them or what holiday we received them as a gift;
- find valuable earrings for going out.
Regardless of the types of objects, be it computer games, spaceship instruments or jewellery, organising their management allows for clear and transparent processes. If we're talking about assets in companies, they deserve the attention of IT and security professionals who have clear tasks:
Searching and accounting
Identification, registration and categorisation of all IT assets, including hardware, software, network devices, mobile devices, user accounts, etc.
Inventory
Get the latest and most complete information with the ability to remove duplicates and enrich existing asset cards.
Lifecycle Management
Plan, control and optimise all stages of the life of assets, from acquisition to decommissioning.
Licence Management
Ensuring that software is used in accordance with licence agreements and procurement management: tracking the costs of acquiring, maintaining and supporting the right licences.
Security
Protect IT assets from theft, data breaches and other threats such as component tampering or third-party software.
Reporting
Providing management and other stakeholders with information on the status of IT assets, building a quality landscape for related tasks.
The IT asset management and inventory management process can be provided by various methodologies:
- ITIL (Information Technology Infrastructure Library): a comprehensive IT service management methodology that includes a section dedicated to ITAM and provides a set of recommendations and best practices for everything from inventory to IT asset lifecycle management.
- COBIT Control Objectives for Information and Related Technologies): a set of guidelines and best practices for IT governance that focuses on controlling and managing assets in a way that ensures they meet business objectives and minimise risk.
- ISO/IEC 19770-1: an international standard that establishes requirements for IT asset management systems and defines processes such as inventory, configuration management, licence management, etc.
In addition to these well-known methodologies, there are many other approaches, the choice of which depends on:
- The size and complexity of the organisation;
- the industry;
- the budget allocated;
- the level of ITAM maturity within the organisation.
In addition to specific ITAM, a more general Asset Management process can also be considered, which is characterised by the type of assets, the objectives of the work, the processes themselves and the tools used.
This process covers a wide range of assets and does not focus exclusively on IT assets, but also, for example, real estate, vehicles, production equipment, etc. While ITAM aims to optimise the lifecycle of IT assets by maximising their value and minimising the risks associated with them, Asset Management - has a more general objective: the effective management of all of an organisation's assets to ensure their safety, profitability and alignment with the companies' strategic objectives.
In general, the asset management process can utilise a wider range of tools, including ERP systems, project management systems, document management systems, etc., without focusing on AM and CMDB class solutions.
It is important to note that ITAM does not replace Asset Management, but rather is a subset of it. Whereas the most common process requires diverse knowledge in different areas (depending on the types of assets an organisation is working with), ITAM requires knowledge only in the areas of IT infrastructure, software licensing and IT security.
If we think back to the examples in the first part of this article, we can identify such assets that will replace games, spaceship parts and jewellery. Instead of toys, books, and clothes, ITAM helps us make sense of the computers, software, phones, and other devices we use. ITAM can be particularly useful for companies where:
- IT costs are high;
- IT infrastructure is business critical;
- there is a risk of data breaches or unauthorised use of software.
ITAM is not a one-off task, but an ongoing process where information about devices, programmes and users needs to be constantly monitored and updated. The process itself can be as complex or as simple as possible, depending on your needs: while a simple list or spreadsheet is sufficient for home use, a company may require a more complex system with automation tools and management of all data from a single window. The ITAM process typically involves the following steps:
1) Defining goals and objectives
The first step also involves identifying the resources needed to achieve them, assigning responsible professionals, and determining regularity.
2) Policy development
In the second, procedures are defined that will govern all aspects of IT asset management, including schedules and third-party involvement.
3) TechnologyImplementation
Programs and services implemented in the third stage will help automate IT asset management processes and make the process as transparent as possible.
4) Monitoring and Control
The stage where you need to constantly monitor and control the performance of ITAM processes, which is helped by automating schedules and routine activities, such as generating a weekly report, categorising assets or providing management capabilities for related tasks.
5) Training
Staff should understand how to work with the ITAM tools used and be involved in updating routines and procedures.
ITAM may sound boring, but it is a very important process that helps protect devices, data and money. It will provide a solid foundation for addressing strategic (threat modelling and risk assessment, document compliance) and practical IT and IS challenges (including asset management from a data protection perspective).
.jpg)
