What best practices have you found for taking inventory of all the systems and applications in your organization (including shadow IT)? How are you tracking and managing your inventory?

Question

Answer

One of the best things we did is compare tools that can compile inventory like data. For example, your antivirus software likely reports total number of hosts its installed on, and the version of OS. How does that compare to your Service Now Inventory? Service Now only shows 5,000 Windows servers, but your AntiVirus says 9,000 were touched in the last 24 hours? Seems like you may have a reporting gap. Many times we could do this comparison just on the raw numbers and confirm we still had a lot more systems to add to Service Now inventory.

Answer

Any inventory of infrastructure assets must be driven by automation. They need robust discovery mechanisms and an accessible API. The challenge of Shadow IT is those devices are probably configured to hide themselves but disabling things like CDP or LLDP. They also probably do not have SNMP configured to standards so they are hard to discover. However in order to be more than just a passive brick they need to be part of the forwarding plane. some more invasive discovery tools can also use routing and Next Hop information to best identify these rouge devices. It is also possible to use MAC tables to look for OUI identifiers of MAC addresses for Networking vendors again to find the shadow IT.
Above all if it is dependent on a human entering data in a consistent fashion its dead before it even starts.

Answer

Agree with - automation - look at tools (e.g. Zluri, Tanium) to get the best picture of what's happening in your environment.

What best practices have you found for taking inventory of all the systems and applications in your organization (including shadow IT)? How are you tracking and managing your inventory?

Content you might like

How much are you using AI in your organization?

Are cryptocurrencies "the essence of ransomware"? https://www.cnbc.com/2021/06/03/ex-sec-cyber-chief-crypto-says-investors-are-enabling-ransomware-attacks.html

What are some ideas to keep up team morale remotely? Are there specific or structured adjustments you've made to counteract burnout/keep up productivity and mental health?

Does anyone have any guidance, tips, and/or templates to share to help establish Identity Access Management governance as a part of an overarching Identity Governance and Administration program?

When evaluating the progress of your team, which metric do you frequently refer to as a barometer of success?