When you hire a moving company, they send out a representative and they do a survey of what is in your house and give you an estimate. A much more difficult scenario is when a federal technology leader tries to get a handle on what they have in their domain and how to maintain it.
To continue the house analogy, if you have a piano it just sits there. In the tech world, virtual assets are constantly being fired up and shut down. Half of the house is in storage (the cloud) and your kids are building rooms off the garage (shadow IT). On top of it all, your cousin with ten kids is moving in (a new federal initiative), and, on top of all that, a thief is trying to get into the kitchen (malicious actor).
No wonder federal asset management is tough.
Fortunately, systems have been developed to assist in this frustrating endeavor. To get a handle on incident, problem, and change management, the Information Technology Library (ITIL) has developed 26 processes that provide guidance. A subset of those processes is called Information Technology Service Management (ITSM).
It is estimated that there is 20,000 Software as Service options for federal systems. All one needs is a credit card to start up systems that make life easier for the user and drive security people crazy. Once an effective view of what is running is established, one can eliminate duplicative services and remove dangerous code.
During today's interview, Malcolm Davis from WWT expands on some basic concepts.
For example, one cannot generate any kind of visibility without automation. Additionally, a federal technology manager must be concerned with topics like maintenance expenses, license consumption, and managing outdated assets.
For example, there are dozens of tools that can be used for system management tasks. An organization may have five tools doing the same task. It is also possible that an agency is paying a license fee and maintenance on four tools they don't use.
Once visibility is achieved then tool consolidation can take place.
Just because you have code that is not active doesn't mean it is not a threat. Malicious actors have been known to bury code into innocuous data that will sit for months. Then, once triggered, it can start its inevitable lateral move.
