While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
Think of the Department of Commerce as a series of 12 bureaus formed over five decades with IT departments that are accustomed to running their own affairs. Given that level of complexity, it’s understandable that while the agency has deployed software asset management, there’s still a great deal of work ahead.
CIO Steve Cooper says Commerce has gained valuable insight into its software assets through enterprise license agreements, tools such as IBM BigFix and through the Department of Homeland Security’s Continuous Diagnostics and Mitigation security reports.
“I believe the real benefit received through these tools is the centralized reporting and identification of all software assets in the agency’s current operating environment, and knowing whether or not the agency is in compliance with licensing and regulations,” Cooper says.
Cooper says that it’s critical for the agency to know more about its software. “Having details on software versions and the ability to remediate vulnerabilities is a key benefit,” he adds.
Amy Konary, a research vice president for IDC, says that agencies should also use asset management software to be more proactive.
“Organizations should not be looking to just avoid an audit, but also to obtain information on usage and license status that can be used to support future software purchases and negotiations,” she says.
At the International Trade Administration, one of the Commerce Department’s many agencies, CIO Joe Paiva uses Microsoft System Center Configuration Manager and performs software management at a fairly basic level.
“I would say we are at the ‘crawl’ stage, where we use traditional agent-based tools to control what software and apps are installed on end-user devices,” Paiva says. “We also do some simple stuff like patch management and power management settings.”
Paiva hopes to expand the agency’s deployment by using traditional agent-based tools or more advanced server-based tools to manage licenses, automatically uninstall software that’s not being used and negotiate better licensing agreements. And in the more distant future, the agency aims to use advanced tools to perform real-time provisioning, installation and license allocation to minimize costs and security vulnerabilities.