How to Gather Trustworthy Data in your Organization

When you're building out a software asset management program, you're going to hear a lot about trustworthy data. Today I'm going to talk about what exactly trustworthy data is. Hi, I'm Mike Austin, Sam expert. In this video we're going to talk about the steps to get to trustworthy data. We're going to talk about software inventory and how to validate it. We're going to talk about license metrics and what's required there, as well as just the general way to calculate whether your data is trustworthy and whether if you were to be audited by a software vendor, it would stand up and win that audit. So check out the link in the description below for downloadable of our data elements that are required for an inventory and license entitlements to pass a Microsoft audit. Now let's get into it. Step one is to identify your assets. The first thing that you need to do in order to check to see if you have trustworthy data is to make sure you have a complete inventory for all of those assets. Samples of the things that you need to collect in order to get trustworthy data are Active directory inventory from your tools such as SCCM, Altiris, Landes, Snow, etc. Your purchase records, as well as potentially your endpoint security software that to see which devices it's actually monitoring. After you've identified your key inventory sources and gone out and collected the information from them, the next thing you're gonna do is create a Venn diagram to show where the overlap is between the different tools. What you wanna see as an example on the screen here is a Venn diagram that shows SCCM data versus Active Directory versus what is in the security tools. And what we're trying to get is where the overlap is approaching that 95%. And so when people talk about trustworthy data, they're talking about the overlap of these three tools being 95%. What that means is I have that device in my ad, so it shows up as an active device. I have inventory on it for my SCCM or my inventory tool. And I can also validate that with a second source such as my IT security tool. If I don't have 95% there, I'm going to want to go and investigate the outliers. So in the Venn diagram, for instance, you're going to Notice that there's 796 devices that are in SCCM. They're not in the security tools and not in AD. Why is that? And so in this specific case, what we would do is we would go out and investigate each of those outliers to figure out why it is and determine what we should do about it. So if I go Back to that 796, in this case, this customer had 796Macs that were not in active directory and not managed by their security tools. So, so we actually could then figure out a policy to ensure that we now know what to do with those max so that we can move those towards the middle to get to a more complete picture and start to approach that 95%. So you're gonna hear 95% quite a bit, or 90 to 95%. The reason for that is you're never gonna get to 100% accuracy in inventory. There's things that are always happening. You're going to have devices that are sitting in your SCCM data for 30 or 60 days that have been retired and no longer on your network. You may have machines that are provisioned in AD that sit in the storeroom that haven't been moved out into inventory yet, so they're not being collected on SCCM. So 100% is probably never really attainable. And that's why you're going to hear a number of people using somewhere between 90 and 95%. When you're in an audit with a software vendor, they want you to be close to 95% in order to trust your data in order to use for a successful audit. So once you've finished putting together the Venn diagram, it's time to then go out and compare your inventory to your purchase records. So really what you're going to be doing here is you're going to look and see do I have an inventory on that device and is it in my purchasing records or not? So where everything is, yes, that's great. Where you get yeses and nos, you're going to want to go out and do some investigation. For instance, if you have that you have a purchase record for a device but you have no inventory on it, you're going to want to go out and find out why. Usually that would be an indicator, for instance, that that device has been lost or stolen, for instance. And so you might want to kick off an investigation to figure out where it is. If you've got no inventory or, sorry, no purchase records and you have inventory on that, then you're actually going to want to look and see why are those devices that your employees are bringing in through, say, BYOD type things, are they contractors devices? What are they? Again, you want to go and look for These outliers to develop policies and procedures around them so that you're ensuring that you have a complete picture of your data. So now that you've determined all the assets that are floating around in your environment and whether you've purchased them or not, it's time to bring us to step two, determining all the data elements that are required to create an effective license position. Why did I use the term data elements in the title? Because there are things that are not true inventory that you're going to have to collect in order to create a proper license position to ensure that you're compliant. So when you look at software asset management, you're typically thinking of publishers and titles and things that are installed on devices. But in order to do licensing correctly, you may have to look at things that are not inventory sources in order to correctly do licensing. An example of that may be you might have to look at your HR records to determine how many employees you have if you're licensing something by an employee based license metric. Let's take a look at a couple of things that are definitely inventory type data elements. We can start with hardware. You're going to be needing things like processor counts, what type of processor it is, the number of cores, inventory. You may need to know the amount of ram. You may need to know the storage that's associated with that hardware. You may need to know the make and model of the PC or server. For software, you're going to also have very defined things that you want to collect. You're going to go out and look for software publisher. You're going to look for the version, the name, the edition of the software. You may also need to understand the license metric. Is it device based, user based, processor core based, etc. Finally, let's talk about some non inventory elements. You may need things like your HR records to determine the number of employees that you have. You might actually need to determine access and who has access to a server that's not within inventory that might be found within something like OU groups within ad. You may need to understand guest to host relationship in a virtual environment is important. In a VM environment you're going to want to know if server mobility is occurring where guest servers are moving between host or if cloud mobility is occurring where they're moving from your data center to the cloud. If you're licensing things in the public cloud like Azure aws, there's going to be license metrics or data elements that you need to collect in order to figure out if you're correctly licensed and those won't be inventory type elements. So the true end game here is to get all of these data elements into some sort of software database, whether that's your CMDB or some other system that you create on your own. It all goes back to getting to 95% data accuracy. Did I inventory 95% of my desktops, servers, laptops, etc. And 2 Do I have all the data elements that are required in my database in order to create an effective license position? This process that we've talked through here today is going to identify any areas where you're missing data and the gaps that you have in your inventory that you'll need to go out and create processes around figuring out how to go and collect the missing information. This will help you defend yourself in audits and also prepare yourself to be better armed in negotiations with your software vendors. Don't forget that different types of software vendors require different data and different data elements, as well as different collection methodologies. This in itself, understanding can be a very complicated task, and if you're just getting started out in the SAM process or the SAM industry, you may not know where to start. In the link below you're going to find a downloadable to find the elements that are required to accurately create a license position for Microsoft. So please feel free to go ahead and download that. If you have any different reporting mechanisms or ways to collect information around trust or the data, why don't you go ahead and put something in the comments below. Thanks for watching. I'm Mike Austin, SAM Expert. Don't forget to hit the subscribe button to follow our channel the SAM Channel Keep your software safe and your assets managed. Until next time, SA.