One way to apply ITSM in practice is by understanding security threats and how to deal with them. After all, this type of tool serves to improve the quality of IT service, with systems that adapt to the company’s needs.
That being said, it is not difficult to understand that ITSM in practice can be successfully applied to security. After all, how many rumors or news of data breaches do not arise per month? In addition, how many attacks do not occur?
How ITSM works
Before we see how ITSM can be implemented in the practice of information security, it is necessary to explain a little about this system. This acronym, by the way, stands for IT Service Management – or IT Service Management in Portuguese.
This protocol model aims to offer a more efficient and quality IT service. It is related to ITIL, since this is the most recognized framework in the use of ITSM.
That is, ITSM, in practice, is a series of tools, software and strategies that are linked to IT. It constitutes a management structure and depends on the effective use of products, people, processes and partners.
In this case, dealing with information security, it has its model that can be applicable. So, it is necessary to see how it can be used, as we will do now.
The definition of threat modeling
Well, now it’s time to talk a little more about the applicability of ITSM in the practice of information security. After all, how to implement it in this area?
First of all, remember what information security means. This concept prioritizes the control of access to information, as the name suggests, with values ​​such as confidentiality and integrity.
Have you ever thought about your site being attacked, your company’s and customers’ data being stolen, and all the consequences that can generate? Well, this is a headache that everyone wants to avoid.
That is why it is necessary to learn to defend your company more effectively against possible security threats. And here comes a function of ITSM.
This is because in your company and your management, it is necessary, first of all, to understand who can attack you and how. Knowing this, you can then think about which defenses you can use to reduce the chances of security breaches.
In this sense, concepts such as threat modeling are relevant, but they do not always receive the value they deserve. What your company should consider, in summary, is the following:
- Critical assets: everything the company has, especially what is most relevant;
- Threats and vulnerabilities: what is in a more vulnerable situation and can be attacked;
- Defenses: how to prevent or minimize the chances of external attack.
ITSM in practice: implementing a threat concept
Now, it’s time to talk about ITSM in practice in terms of creating and implementing a security concept. This concept must deal exactly with what I discussed above: critical targets, threats and vulnerabilities, and defenses.
In this case, it is important to think about a few more issues. In summary, they are these:
- What am I operating, building or protecting?
- Who can attack me and how can they attack me?
- How can the attack be beneficial to the intruder?
- How can the attack be detrimental to my company or customer?
- How can I detect, prevent, and respond to vulnerabilities and threats?
- Am I succeeding in this (prevention, detection, and response)?
Therefore, think of steps to produce the model. Firstly, plan and discover the degree of threats, collecting information related to the system and company management.
Then, start building data flows, information, processes, and controls to help build the threat model. Next, put this model into practice in different teams within the company.
Evaluate your company’s threat modeling
In conclusion, it is important to understand that implementing the ITSM model allows for the creation of threat modeling systems, which aid in information security.
Once you focus on vulnerabilities and potential threats, it helps security teams control them. Thus, you decrease the risk related to your business.
English 
