Kevin T. Geil · Principal Consultant · Placid Security
Most organizations treat IT management and information security as separate functions — separate teams, separate budgets, separate conversations. In my experience, that separation is the root cause of a surprising number of security failures.
The two disciplines share a common foundation. Effective IT management requires that you know what technology assets you have, understand how they’re configured, and control changes to both. Effective security requires exactly the same thing. Asset inventory, configuration management, and change control aren’t just IT best practices — they’re the bedrock of a defensible environment. You cannot protect what you don’t know you have. You cannot detect anomalies in configurations you’ve never baselined. You cannot investigate an incident if you don’t know what changed and when.
“Get those three things right — know what you have, know how it’s configured, and manage changes to both — and your security posture and your IT operations improve simultaneously.”
When IT and security teams operate in silos, organizations end up duplicating effort, stepping on each other’s toes, or — worse — leaving gaps that neither team owns. The security team discovers an unmanaged asset during a pen test that the IT team thought was decommissioned. The IT team deploys a new system and doesn’t loop in security until after the fact. The change management process exists on paper, but security doesn’t have visibility into it. These aren’t security problems or IT problems. They’re organizational alignment problems with security consequences.
The good news is that the fix isn’t complicated, even if it takes sustained effort. It starts with shared visibility: a single source of truth for assets, configurations, and changes that both teams can see and contribute to. It continues with process integration — making sure security review is part of the change process, not bolted on after the fact. And it requires leadership that understands why this alignment matters and holds both teams accountable for it.
Organizations that get this right don’t just have better security. They have more efficient IT operations, fewer surprises, and a clearer picture of their own environment. That’s the goal. That’s what Placid Security helps build.
This post is drawn from Kevin’s 2021 SANS Institute Reading Room paper, “IT Service Management and Infosec: Collaborate for Mutual Success.”
Read the full paper at SANS.org ↗
Let’s talk about how asset management, configuration control, and change governance can strengthen both your IT operations and your security posture.
Schedule a Conversation