Critical Issues in IT Asset Management

Transcription

1 Western Region Fall Education Seminar Salt Lake City, Utah 2015 Critical Issues in IT Asset Management Norman Pugh-Newby Deloitte November 4, 2015

2 Agenda ITAM Why It Matters? Definition & Objectives IT Assets What Are They? Conceptual Model Objective State Critical Issues How Effective Is Your ITAM Program?

3 IT Asset Management Why It Matters Big Bucks: Annual Federal IT Buy ranges between $76B and $80B Private sector IT investment also very significant GAO, IGs and auditors find Poor Financial Management & Excess Procurements GAO and IGs find many organizations simply do not know what they have in the area of IT assets Security is an increasing challenge and you cannot secure what you do not know you have GAO finds most Federal Agencies lack goals, purpose or metrics for the IT enterprise ITAM provides visibility of IT assets and how they relate to mission needs.

4 IT Asset Management Definition & Objectives IT Asset Management (ITAM) The integrated management of an organization s IT asset inventory, policies, processes, tools, and resources in order to support life cycle management of Information Technology assets Objectives: Establish and maintain physical accountability of IT assets Allocate assets as efficiently and productively as possible Provide accurate configuration status of assets in accordance with defined standards Maintain full compliance with software licensing agreements Establish a centralized and complete asset information repository to support day-to-day IT operations and maintenance functions, plus IT asset life cycle management

5 IT Assets What are They? IT Assets include all elements of hardware and software found in an enterprise environment Consist of 6 asset categories with discrete asset contents: Facilities Cable Plant Server Facilities LHI Storage Network End User Devices

6 IT Asset Management Conceptual Model 2 core processes (Accountability Management and Asset Operational Management) 4 interfacing processes (Financial Management, Procurement, Configuration Management and Assurance Management) The interfacing processes collaborate with each of the core processes Effective IT Asset Management is a multifaceted inter-related process performed by a knowledgeable and integrated ITAM team

7 ITAM Objective State Enterprise ITAM is a multi-functional system, with multiple integration points and data feeds. Each integration point provides key data feeds supporting the enterprises operations, management, and reporting capabilities.

8 Critical Issue #1: Poor Accountability Management IT Asset accountability management is the process of establishing and maintaining accurate accountability records of the IT assets under your control Managing IT asset costs requires tracking IT assets across the entire asset lifecycle until they are no longer of capital or regulatory value. Effective asset accountability management requires the support of automated tools 3 distinct types of automated tools are typically used to support an effective asset accountability program: 1. Auto-discovery 2. Repository 3. Usage

9 IT Asset Discovery Discovery is the process of identifying all the IT assets that are in the network Assets are typically comprised of servers, network equipment, storage devices, computers, printers, monitors, external peripherals, cable, and leasehold improvements The discovery of IT assets can be automated via the use of auto discovery tools which generally work in two distinct methods: Agentless Tools: Agentless tools discover network devices automatically by scanning an Internet Protocol (IP) address range Agent-based Tools: Agent-based tools require the installation of an agent on the networked device One pitfall of auto discovery tools is that they are often encumbered by firewalls or governing security policies

10 Asset Reconciliation Between Discovery & PMIS Data Reconciliation: An important part of the process of ensuring that inventory information is accurate is to reconcile information from discovery database to information in PMIS. The following diagram represents how asset data could be reconciled between PMIS and Discovery Tool to improve inventory accuracy. Asset Reconciliation between Discovery and PMIS Agent or Agent less Network Discovery tool produces dashboard and reports showing devices on managed network on periodic basis Information Security Team Information transmitted to Discovery Database Y END Title OIT & OMS Personnel reconcile information from PMIS and Discover (Automatic process to compare information in the two datasets) Reconciliation Report Does the report indicate that information matches Devices not on PMIS list discovered Information Security Team validates additional devices on network thru certificates or other means OMS Team OMS Personnel work with OFA personnel to create baseline inventory Baseline created PMIS Information PMIS devices not Active on Network Device Status Updated Property Manager works with Information Security team to confirm device status and updates PMIS Legend PEAKING CA YOUR Key Control INTEREST System IN or ASSET MANAGEMENT Document or Process Activity # Activity Database Report Decision Point

11 Critical Issue #2: Wasted Software Dollars Software license management requires an understanding of where licenses are consumed (Software usage Tool), identifying potential savings, and aggregating costs An important goal of Software License Management is to eliminate software overbuying and illegal use o Harvest unused and low level used licenses for reuse o Audit licenses being used with licenses paid for Potential 30% software cost savings form reducing software maintenance quantities to match optimal deployment.

12 Critical Issue #3: Poor Financial Management Financial Management The process used to plan and manage cost allocations across departments for asset procurement, maintenance, and related services It enables control and accountability for spending at the organizational and departmental levels, based on actual need Aids in reducing waste and increasing efficiencies in spending and usage associated with assets and services Financial Management includes: Expense Forecasting Accurate Tech Refresh required to support baseline plan Investment Decisions Framework of costs vs. benefits during budget reviews Charge-back charging IT costs back to the using departments Policy Compliance e.g., DoD FMR Vol 4, Ch. 6, Accounting for PP&E Cost Allocation/Tracking Supports cost control and governance. Depreciation Allocates cost over useful life of assets Business Case Analysis Foundational analysis for justifying IT investment $$$

13 Critical Issue #4 Ineffective Procurements Procurement The procurement function involves the acquisition of network components and services with the following considerations to benefit the network operators and customers: Best possible total cost of ownership Right quantity and quality Right time Right place Right source The procurement process typically involves risk in either the cost or benefits and is a good business practice to make use of economic analysis methods such as cost-benefit-analysis or cost-utility analysis An Information Services Procurement Library is a best practice library for the management of IT related acquisition processes Ensure the property management team is linked-in to the procurement process

14 Critical Issue #4 Ineffective Procurements Contract management can be summarized as the process of systematically and efficiently managing contract creation, execution, and analysis for the purpose of maximizing financial and operational performance and minimizing risk managing the buy Contract management should ensure that products and services covered under the contract are provided in the required quality and quality, and within the prescribed timeframes Understanding, predicting and being able to effectively mitigate risk are critical to effective contract management Help yourself to mitigate risk by creating a historical database with details of critical issues associated with previous contracts such as: Real costs and duration versus budget and planning schedule Problems/solutions to include contract decision point challenges Effectiveness of suppliers and delivery plans Quality of supplies and services

15 Critical Issue #5: Unsecure Networks Lack of an accountability baseline for comparison with results of network security scans Lack of information exchange between critical ITAM business processes (Accountability Management, Configuration Management, Security Management) Lack of effective network access policy, procedures and governance

16 Critical Issue #6: No defined Goals, Purpose and Associated Metrics for IT Enterprise (GAO 2012 Study) Agency Department of Education Department of Health & Human Services Department of Agriculture Department of Commerce Department of Defense Department of Energy Department of Homeland Security Department of Housing & Urban Development Department of Justice Department of Labor Department of State Department of the Air Force Department of the Army Department of the Interior Department of the Navy Department of the Treasury Department of Transportation Department of Veterans Affairs Environmental Protection Agency General Services Administration National Aeronautics & Space Administration National Science Foundation Nuclear Regulatory Commission Office of Personnel Management Small Business Administration Social Security Administration US Agency for International Development GAO Assessment: IT Goals & Purpose Defined

17 How Effective Is Your ITAM Program?

18 Questions? Norman Pugh-Newby, CITAM, CPPA, PMP Specialist Master Deloitte (M)