The Biggest Irony in Technology

In short: IT is not being used effectively to manage and assess itself

And, no, I’m not talking advanced AI, machine learning or self-healing here (although these “AIOps” things can be amazing with the right foundations in place) I’m talking about the basics of knowing and managing your IT assets. This is a fundamental part of what is referred to as IT hygiene.

Computers by their very nature are things that can be queried, inspected and changed automatically and programmatically. Modern DevOps and cloud are great examples of automation creating business outcomes using things like Infrastructure as Code (IaC). However, in most cases today, computers are still being cataloged manually by burdensome and broken processes. Why should we rely on manual processes to manage and control technology assets? These things are digital already, but the management of them is in dire need of transformation. It’s also starting to really hurt large organizations—a lack of true visibility makes business agility and effective risk management near impossible and financially, a mess, thanks to numerous inefficiencies in people, process and technology.

How did we get here?

This is a classic ‘the cobbler’s children have broken shoes’ situation. IT is often so focused on delivering direct business value that there isn’t the time or budget to manage IT itself better. However, this gets super embarrassing for organizations when they get breached after someone forgot to do the basics of IT hygiene (including patching, configuring and maintaining systems) and the IT team finds out they didn’t ever have full visibility of the assets the organization has. Maybe external auditors then come in to do an IT audit and in many cases, the only way to do it is for consultants to go around with clipboards and spreadsheets and work out what is what in order to assess the health of an organizations controls or compliance status.

But we don’t have this problem! We’ve already solved it with ITSM/SCCM/ABC/XYZ!

Perhaps some of you are thinking. “We’ve solved this using existing systems management and IT Service Management (ITSM) solutions and frameworks like the Open Group’s IT4IT and ITIL.” These are indeed often part of the answer. However, many of these systems often don’t work properly or don’t scale with the organizations. Why is that? It’s the way they are built. They are built on centralizing data – but data has gravity – and moving gigabytes of data around is inefficient and costly. And, crucially, they’re not delivering on the promise of automation when they are being fed by error-prone manual data, fragile processes and/or disparate CSV files that have to be imported.

Amazingly, this is a problem that many big tech companies have failed to solve in a way that actually works reliably, scales effectively to the vast numbers of devices that enterprises now have, and offers a complete solution. The reality is that many organizations have rushed to deploy tactical point solutions that fix a specific pain point (or because they were drawn in by excitement over a shiny new tool), not realizing that they actually just make IT management even harder by adding additional complexity and more IT infrastructure to power these many point solutions.

This situation has only gotten worse in recent times with increasing regulations and focus on cybersecurity. More and more point solutions have been deployed to fix data leakage, insider threats, advanced malware, PCI compliance, zero-day threats, firewall management, virtual patching (the list goes on) in many cases however these have just made the problem worse – adding yet further complexity and often distracting IT operations teams from managing the basics of the IT environment. And as Gartner has noted, “Remember: the maturity of the security analytics program does not correlate with the number of tools.”

A smart platform approach

There have been massive efforts to create business platforms and many books written on this topic, yet taking a platform approach to solving the IT visibility and control problem is relatively novel. In many of my regular meetings with IT stakeholders, it requires more explanation than I would have expected to imagine a world that looks more like this:

It helps to think of this again in terms of how platforms arrived to simplify other parts of the business, but not yet IT management. Other departments figured out a long time ago that it isn’t worth spending time and money architecting and integrating lots of different separate point solutions if you can effectively manage your challenges with fewer strategic platforms. Not only is the management of the IT estate easier, more automated and more effective, but teams realize additional benefits, such as:

• Proactive incident response
  Increased visibility of IT landscape by knowing exactly what hardware and applications etc you have now (not last week or how old the database is) and then being able to drive proactive (and automated) actions from that data. When you have the vital foundation of knowing what you have in place, cyber incident response is far easier and you dramatically shorten the time from detection to correction.
• Cost and complexity reduction
  Costs of infrastructure and keeping the lights on for point solutions really add up. Particularly when they need 100s or 1000s of servers in order to scale to the size of the organization. Reducing and removing these demonstrably reduces costs and complexity.
• Joined-up data
  Breaking down silos across teams by having a single source of the truth along with the ability to take action in a collaborative manner. This data can be fed into other systems such as the CMDB to improve IT operations processes.
• Improved performance of computers and networks
  Point solutions often require a specific agent(s) to be run on endpoints. These solutions create overhead by sapping your computers CPU and memory – slowing down performance. Additionally, many of these solutions generate vast amounts of network traffic – slowing down the internet and network speeds.

In one of my future articles, I’ll look at why data lakes are sometimes a hammer looking for nails–and not necessarily helping with the challenges of management complexity. Get in touch if you’d like to learn more or to share your views!

Interested in seeing Tanium in action? Schedule a one-to-one demo or attend our weekly webinar. Talk to our Tanium experts at our upcoming events.