CAS in IT Security Management