By Tom Schmidt
It's a topic no enterprise likes to talk about. But the fact is, few organizations today have a thorough understanding of what, exactly, is on their networks at any given time.
It's not hard to see why, of course: Remote access; the increasing proliferation of mobile devices; contractors with network access; reorganizations; employee transfers; system and space redesign; new installations, system retirements -- all contribute to what has been called "network evanescence," a state of affairs where devices appear and disappear on the network more quickly than their presence or absence can be discovered through scanning techniques. For today's enterprises, real control of the computing environment must begin with the relatively mundane task of -- being aware of everything that is on the network.
An effective asset management solution enables organizations to feel secure knowing that they have a complete inventory audit without the need for physical or manual checking.
Spanning the enterprise
Keeping track of an organization's machines isn't just bean-counter busywork. It's an essential enterprise task that facilitates hardware and software management, license compliance, regulatory compliance, and security. Indeed, a successful asset management solution can save companies time, money, and lots of management headaches.
Such a solution is essential for tracking all of an organization's hardware and software assets. It can tell you where they're located, how they're configured, and when any changes are made to them.
Modern trends towards system leasing and IT service outsourcing can reduce operating costs, but control is vitally important to obtain maximum benefit. Poor hardware inventory can result in increased cost if additional products are subsequently discovered outside the outsourcing agreement.
In another situation, determining the costs of and planning an operating system upgrade is difficult without accurate inventory data. An asset management solution can provide an audit of manufacturer model and serial number, processor configuration, and even memory installed with free slots. Thus, memory upgrades and disposal can be fully projected up front.
Additionally, software license compliance requires an accurate audit of all software applications installed on client computers across the network. An asset management solution can audit this information quickly and then help an organization separate primary applications from operating system and shareware software. It can also identify installations of products no longer in use as well as redundant software, - resulting in significant cost savings.
Client computers may also contain software downloaded from the Internet, which can threaten the security and integrity of the network. Identifying such software is increasingly important as the number of Trojan viruses grows.
An asset management solution's network inventory tools will show the computers in an organization, but what about the other network devices and appliances? The solution you choose should be able to locate every IP device on the network, including any computers that do not have the client agent installed.
The new regulatory landscape
Changing regulatory requirements are also forcing IT managers to track their network assets more closely.
As Jane Disbrow, an analyst at Gartner Inc., told Computerworld recently: "If you don't know where all your laptops and software are located, how can you tell regulatory bodies that customer information is being kept private?"
To help meet regulatory requirements such as the Sarbanes-Oxley Act, managers -need to make sure that the financial information on their software and servers is adequately safeguarded and that they have a sufficient disaster recovery plan in place for each site.
Sarbanes-Oxley is having a dual affect on IT asset management practices. Under Section 404 of the law, companies are required to attest to the internal controls that are used for financial reporting. These include IT-related controls that organizations have in place to effectively track and monitor hardware, plus software used to support financial reporting. Companies are also required to disclose to regulators all material financial exposures they have, including IT equipment leases and licensing agreements, which have to be tracked closely.
Just how central asset management is to regulatory compliance was underscored by a survey of 220 IT decision-makers published late last year by AMR Research Inc. AMR found that companies that consider regulatory compliance the top business issue affecting their security spending cited the need to invest in auditing and asset-tracking tools as their No. 1 security budget priority.
Keeping track of the mobile workforce
Today's increasingly mobile workforce also raises some key asset management issues. In many cases, mobile technologies have been central to the creation of the so-called "real-time enterprise." These same technologies, however, have also increased enterprises' exposure to security risks that are frequently underestimated or misunderstood.
More complex worms and viruses -- known as "blended threats" -- are becoming the attack of choice among Internet vandals. Such threats often exploit several different flaws to increase the chance of infecting a computer system. That's especially disturbing news for clients that regularly travel outside the perimeter firewall and connect to the network. Why? Because blended threats specifically target devices outside the firewall in order to gain unauthorized enterprise network access during an ISP connection. And when an infected device establishes a VPN connection to a corporate system, the perimeter security system is completely bypassed.
Bottom line: All the more reason to strictly track how any mobile devices are accessing the network.
Conclusion
Asset management can be a time-consuming and complex task, one that is greatly benefited by software designed to facilitate discovery and hardware and software inventory assessment and management, license compliance, regulatory compliance, and secure disposal.
Automated discovery of hardware and software allows IT managers to learn what systems are connected in any fashion to the company network, and to know what applications are on each system. Asset management solutions also allow IT managers to redeploy unused software licenses and maintain legal license compliance without automated metering. And when systems are retired, these solutions help you know without question that all corporate data and applications have been thoroughly erased.
Little wonder, then, that asset management is fast becoming a business-critical IT task.
Tom Schmidt writes frequently about information security topics. He has more than 15 years' experience as a writer and editor in high-tech publishing.