Who watches the watchers? - Including ITSM, ITOM, APM, and CMDB in your audits

This vendor-neutral talk argues that the operations tooling most organisations run, including monitoring, configuration databases, ticketing, batch schedulers and automation, is rarely examined closely in security audits. These systems often hold privileged access and a detailed picture of the environment, so an attacker who reaches them gains a map of critical assets and their relationships. The speaker notes that even read-only access to a configuration database can reveal business services, their dependencies and version numbers without the noise of active scanning.

The middle of the talk walks through tool categories. Agent and agentless monitoring, application performance instrumentation that hooks into live runtimes, and real user monitoring via JavaScript injection can all add latency, crash applications when misconfigured, or expose personal data when marketing scripts are added. Trouble ticketing and runbooks can show recurring problems that make new disruptions look routine, and logging levels raised during troubleshooting may never be restored. Batch scheduling and robotic process automation usually run with broad file system, database and ERP privileges while generating few security events, so misuse can blend into normal operations. Patch windows and on-call lists also create openings for social engineering.

The closing guidance is practical. Review service accounts and their rotation, include batch scheduling and automation in audits, log API access with source addresses, and confirm that logging is returned to normal after changes. The speaker also suggests mapping these controls to OWASP SAMM activities and integrating SAMM with ITSM practices where no mapping exists yet, while noting that the work needs dedicated service management staff and closer collaboration with application teams.