Reducing vulnerability through strategic software asset management

Over two decades managing software assets and licence compliance, working in-house at HE institutions and in my current role for Jisc, I’ve seen first-hand how demanding a job it can be to keep track of software updates and licensing.

Perhaps more than any other type of organisation, the tertiary education sector has a uniquely large task on its hands. Institutions pay for and use hundreds or even thousands of software installations, which are often not managed centrally and have no single point of visibility.

As staff and students enrol and leave, IT managers have to cope with a constantly shifting user base. Add to that the complexities of multiple departments, campuses and device types and it soon becomes incredibly difficult to track which licences have been bought and are in use, which instances are updated to the latest secure versions, and whether software is being used in line with licence terms. These difficulties are a natural consequence of operating in such large, diverse and fast-moving education environments, rather than any indication of local issues.

As higher and further education institutions face mounting pressure to maximise value and minimise risk, software asset management offers a powerful way for them to gain greater control of the huge array of software deployed across their estates.

Risks of not using strategic asset management

The inherent difficulty of maintaining full oversight of software estates isn’t just an administrative burden. It presents very real risks for every institution.

Increasingly, we’re finding that senior leaders are aware of the security risks associated with unpatched or outdated software versions, and the high profile of recent hacks in the commercial world has focused minds on this. Strategic asset management enables IT teams to identify vulnerabilities and take a proactive approach to patching. It also helps to spot unapproved or unmanaged applications (“shadow IT”) software, which can introduce risk through unapproved or insecure applications.

The financial benefits of using strategic asset management are perhaps less well known, but they are significant. Having full visibility of software in use enables institutions to consolidate licences or switch to more cost-effective alternatives. It also reduces the risk of wasted spend on duplicate, unused or under-used software.

Additionally, using software in a way that breaches its licence can be an expensive mistake. Academic licensing often has specific use rights; For example, using a classroom version for research may breach licence terms, and could lead suppliers to withdraw academic pricing altogether.

Put simply: If you don’t know what you’ve got, how can you assess the risks, or the opportunities for savings?

The steps to strategic asset management

At Jisc we have licensed products that support software asset management, and in preparation for strategic asset management, there are practical steps institutions can take to start gaining control of their assets and making better use of existing products.

Discover and reconcile

Find out what’s on your estate and compare that with what you know you have bought. Tools are available to assist with building an inventory of installed software across the estate, and the versions in use. You can also speak directly to software providers to ask them what they have provided your institution, and your procurement teams should have helpful records. To some extent this will need to be a manual process, but Jisc, my team and I are here to manage relationships with vendors - ensuring proper advice and guidance are shared, complementing our agreements.

Record and manage

Once reconciled, you’ll need a way to record your findings. A dedicated strategic asset management tool can help with this, enabling IT teams to track updates and even block access to outdated or unpatched versions.

Reduce the potential for future unmanaged growth (‘sprawl’)

Once you’ve got a handle on your estate’s software usage, you will want to keep it under control and centrally managed.

Limit the number of ways software can enter the organisation. For example, you could lock departmental credit card use for software purchases and ensure all software requests are routed through the service desk.

Real-world experiences of strategic asset management

Members who have been through the process of implementing strategic asset management at their institutions have shared some insights with us, and it’s clear there are some common challenges as well as some great examples of successes.

Challenges they tell us about include:
Lack of resource and time to manage central software recording effectively
Duplication of software requests based on personal preferences
Staff obtaining software without IT approval
Internal resistance to installing third-party agents for data collection
Multiple purchasers buying conflicting or duplicate software
Finding the right strategic asset management tool at the right price for education
Perceptions that strategic asset management is a monitoring rather than a support and governance mechanism

Meanwhile we’ve heard about successes such as:

Internal audit recommendations gaining senior leadership attention and approval for strategic asset management investment
Establishing central records of all software in use
Beginning the shift towards centralised purchasing
Implementing policies and procedures to strengthen governance
Strengthening vendor engagement and negotiating more favourable arrangements
Avoiding duplicate purchases and consolidating licences across departments