Donald Rumsfeld once made a speech concerning “known-knowns, known-unknowns and unknown unknowns” (what a star!) The scope verification process seeks to find out those known-unknowns. Any devices coming onto the network and within the scope of your SAM Framework should have the capacity to be audited (be it via a dedicated agent, or through capture of data from a deployment/inventory system such as SCCM, LANDesk, etc.) The best way to address this would be through having rigorous build processes in place to ensure that agents are configured on devices PRIOR to going live on a network, but some devices do sneak through. Equally, Mergers and Acquisitions can produce widen the scope of your SAM Framework at an exponential rate – and this process could help identify those devices that you are expected to monitor for Software Asset Management purposes.
|1.10||Subject to both assumptions being met, the Info Sec Manager conducts a trawl for all known devices that the Anti-Virus system covers. The Info Sec Manager then relays that data to the SAM Manager.|
|1.20||The Inventory Tool Manager also conducts an inventory sweep of all devices in the SAM Framework scope. The inventory Tool Manager then relays that information to the SAM Manager.|
|The SAM Manager then looks to compare the Info Sec Inventory data against the device inventory data. There should be three categories any of the devices can fall into:
It’s important to choose the correct data field to compare devices against; Machine name is not recommended; nor IP address; Mac address would be the preferred option, as it is least open to corruption.
|1.40||From the result generated at 1.30, the Info Sec Manager takes report No. 3 and then raises a request to have Corporate Anti-Virus software installed on those devices, which hands off to the Change Management Process.|
|1.50||From the results generated at 1.30 the Inventory Tool Manager takes report No. 1 and raises a request to have an inventory agent placed on those devices; which hands off to the Change Management Process.|
At least within the Change Management Process highlighted in this book; a license-check takes place to ensure that enough licenses are in place prior to deployment. A small point of order, is that if your inventory system is different from your SAM suite, then there could be consequential costs to be borne out of managing those additional systems if your SAM suite license is billed according on the number of devices it oversees.
To return to the Donald Rumsfeld quote above, the only devices you should be wondering about after having run this process are those devices that are missing both Anti-Virus software AND an inventory agent/inventory capabilities.
The process kit by Rory Canavan is available from SAMcharter.com