Rants
Questions
Soapbox
Best Practices
Apply today for a FREE subscription to CIO Magazine!
Thu, Jun 28, 2007 10:31 EDT
|
Posted by: Kris Barker in Best Practices Topic: IT Organization Management
Current Rating: |
Simple IT Blind Spots Can Derail Even the Most Strategic IT Department
As IT departments evolve into larger, more sophisticated, and more strategically relevant divisions within organizations, expectations of business alignment and accountability for every IT dollar and decision swell within management ranks. However, this breakneck pace of change can cause even the most savvy CIO to lose sight of the very fundamentals of accountability that enable strategic-level success in the first place.
Consider this litmus test: Your CFO requests answers to several questions; can you deliver answers in 30 minutes or less?
• Is all of our software legally licensed? If audited by a software vendor, would we be at risk of prosecution?
• Are employees running applications that represent security threats?
• How many of those expensive CRM licenses purchased last year are actually being used?
• Will a migration to Vista require major new investments in hardware?
• If a business unit were wiped out by a flood, how would we know what hardware or software assets were lost?
If you can’t confidently answer questions of this nature, your organization is at risk either legally or financially. This is where bad things suddenly happen to good IT people – people who have the strategic interests of the enterprise at heart, but lack the comprehensive insight into the network assets and utilization needed to eliminate critical blind spots and avoid catastrophe.
As with driving an automobile, eliminating the blind spots means adjusting the mirrors and looking at things from a different angle to see what is not ordinarily apparent. CIOs must secure resources for IT asset management (ITAM) processes and auto-discovery tools that will provide much-needed visibility—and therefore control—over the inventory and usage of IT assets. With such tools in place, not only can IT departments more effectively avoid nasty surprises, but they can also free up costly overhead associated with routine manual processes and unnecessary fire drills—devoting more time to mission-critical operations and other strategic projects.
Here are some of the blind spots you can overcome and avoid by achieving a deeper understanding of the desktop environment:
1) Corporate software piracy
According to the Business Software Alliance (BSA), more than 20 percent of installed software in the U.S. is non-compliant. The ramifications of corporate software piracy can be enormous: copyright infringement penalties of up to $150,000 per infringed-upon title (not including legal fees), business disruption associated with protracted
Very useful article, thank you. However, doing remote audits of all applications being run by employees smacks too much of big-brother to me. In our company many people work remotely and some use their personal computers to do office work. How can we balance their expectations of privacy with the necessity of securing the enterprise? I realize that legally we may be able to run such audits, but what is the impact on morale if the employees feel like they are being monitored?
There are two points to consider here, 1. You should have a company handbook or policy that states that the company / organisation audits computers for software. 2. Communicating with the staff why you are doing something.
If you supply home working staff software for their own computer then you are entitled to provide a service to ensure it is up to date.
The "usage" is virtually immaterial if you read License Agreements it is based on "INSTALLED" software not "USED" software.
When using company assets employees should have no expectation of privacy. If they are using personal computers to do office work, then the organization is mixing and matching their licensing issues. The risk to the organization of security breaches and software licensing violations is considerable. Each violation can cost the the company lots of money - consult the BSA and RIIA fine structures for yourself - and, you'll still have to "true up" with the software publisher anyway.
Plus, IT asset management data is fundamental to understanding and controlling IT costs so that your IT organization can demonstrate alignment with business services objectives.
IT Asset Management is one of those fundamental "run the business" activities that is poorly done because it's not sexy - yet, according to Gartner, "customers that commit a minimum of 3 percent of their annual operating budgets to ITAM programs and tools can expect a 25 percent reduction in their total cost of ownership."
A high risk of not doing ITAM, and a big payoff for doing it well. The first step is to get some help understanding what the possibilities are. The failure rate can be high for those that don't fully understand the commitment needed to achieve a proactive solution.
The focus on using the network only to inventory assets ignores the machines that are disconnected. It also ignores the logistical processes of moving IT equipment into a building, to its deployment location, and then back out of the enterprise (for retirement/disposition). Also, there are a lot of stored assets such as spare parts and still-in-box equipment that network discovery tools can't see. Network discovery is a great, low-overhead first step--- with IT environments growing so quickly a CIO probably cannot afford to overlook all the infrastructure and items not on the network.
Good point - tracking disconnected equipment can be a real headache, and there's no perfect solution. The choices are to perform a manual inventory, use a remote inventory client (an agent run on a disconnected computer from a floppy, CD or other media), use a network client to collect data when machines reconnect to the network, or use RFID/barcode tagging. Of course, these methods each have their own pitfalls... Manual inventories are incredibly time-consuming, error-prone and non-dynamic; remote inventory clients need to be run manually and don’t address the issue of “missing” devices; network clients only work when machines reconnect to the network and therefore don't take into account systems sitting in storage closets or on loading docks; and RFID tagging tracks movement of machines but does not transmit critical software inventory or hardware information for individual PCs (plus, it's expensive and requires manual work to tag the equipment in the first place).
At the end of the day, companies need to develop IT asset management processes by which equipment details and locations are documented and maintained "from cradle to grave". This might include, for example, a "discovery" tool that tracks current inventories of all networked hardware and software, as well as processes that are kicked off when new equipment is purchased, retired, and/or moved, notifying the people that need to track this information. IT asset management tools can help, but they will never supplant robust, carefully-planned documentation processes.