In this lesson,
we're going to talk about asset management,
including inventory lists, database systems, asset tags
and IDs, procurement life cycles, warranty and licensing,
and the assigned users.
But first, let's talk about
what asset management actually is.
Asset management is a systematic approach to the governance
and realization of value from things that a group
or entity is responsible for over its entire lifecycle.
Now, asset management can be applied
to both tangible assets, things like buildings, equipment,
computers, and servers, as well as to intangible assets,
things like your human capital
or human resources, your intellectual property,
your goodwill, your reputation, and things like that.
When you think about asset management,
remember it's a systematic process of developing, operating,
maintaining, upgrading,
and disposing of assets in the most cost-effective manner,
including all the costs, risk,
and performing attributes associated with a given thing.
In the IT world when we talk about an asset in general,
we're usually referring to a workstation, a laptop,
a desktop, a server, or something like that.
But the term can be used very broadly,
and I've seen people call things like printers, cell phones,
tablets, mice, keyboards,
and even IOT devices as assets in the company's inventory.
So when you're looking at your assets,
the first thing you need to do is have a complete inventory
or list of all of the different assets in your organization.
In a company of my size, it's pretty easy
because we only have about 20 to 25 employees,
which means we have about 100 to 200 assets.
But in some of my previous organizations
where we had over a million end users across six continents,
that asset management becomes a nightmare if you're trying
to do it with a simple spreadsheet or inventory list.
For this reason, we often will use a database system
to do our asset management for us.
When you're using a database system, this will be a system
that allows you to manage
and configure all the details across all
of your different devices
or assets, including their type, model, serial number,
asset ID, location, the users assigned to it,
the value of that device,
and any service information you have.
All this can be a part of an inventory management suite
or asset management suite of products that will be able
to do this for you in a more automated method.
For example, many of the configuration management systems
and trouble ticket systems
can integrate an asset management component
into them as well.
This will allow to go out, scan the network
and find all the assets connected
to that particular network, including things like desktops,
laptops, smartphones, IOT devices, tablets, servers,
and other devices that are all being connected back
to this network.
Now, this isn't going to be able
to automatically find things like mice
and keyboards for you, but it will be able to do a lot
of the work for you,
especially for those higher level assets.
And so it is a great idea to use one
of these database systems.
In addition to having a complete database using one
of these asset management systems,
if you tie it into your ticketing system,
it'll also allow that system to associate that user
with the workstation that's having the issue.
And you can see all the history on that workstation,
such as has the hard drive ever been upgraded?
Have you ever changed out the memory?
Have you replaced a power supply?
And all of those things can all be tracked
to manage from within the asset management database system.
Another thing you need to think about
with asset management is how do you uniquely identify each
and every workstation out there?
For example, in my last organization
where I had 15,000 end users,
I had about 10,000 desktop computers that I had
to manage for all of them.
I needed a way to uniquely identify each
and every one of those desktop computers.
And that wasn't a really easy task just by looking at it
because we used the exact same make
and model for every single user across the network.
So they were all using the exact model.
Let's say it was a Dion 123,
and they all looked exactly the same like a black tower.
So how do I identify
that this Dion 123 is actually the asset used by Jason,
and the other one is the one being used by Susan?
Well, most of the time you're going to identify each
and every asset using a unique asset tag
and a unique asset ID.
An asset tag is going to be either a barcode
or a radio frequency ID tag that's going to be assigned
to that particular device and labeled onto it.
This will allow you when you're doing your annual inventory
to go around with a handheld scanner
and be able to read those barcodes
or be able to read those RFID tags
and get information about that particular asset.
Being able to have an asset tag with a unique ID for each
and every asset across your inventory is critical
to ensuring you have good governance
of your assets throughout the organization.
That way, even if somebody picks up a workstation
and moves down the hall to a new office,
the next time you do that scan, you're going to see
where that asset is and its new location.
In addition to this, you should also be doing
good change management practices to ensure
that anytime there is a move going on like that,
you're notified about it
so you can update that in the database instead
of finding out about it after the fact
when you're doing an annual inventory.
But again, not everybody's going to notify you 100%
of the time, and that's why it's still a good idea
to do annual inventories and inspections
to verify the assets are where you think they should be
and they're actually sitting in the right locations
because you can tag them and then check those tags
and IDs across all of your devices.
In addition to that, it's also important
to think about your procurement lifecycle
when it comes to an asset.
Now, when I talk about the procurement lifecycle,
I'm talking about birth to death of a particular asset.
So if I want to get a new laptop that is the birth, when I go
and procure that and buy that asset
and bring it into my system.
The first thing I should do when I buy a new asset is I need
to assign it in the database
with a unique identification number
and then I need to tag that device.
This way, that device can be tracked across the organization
anytime it's moved, changed, or upgraded.
By doing this, you can make sure
that you have begun the asset procurement lifecycle
and track it all the way through
until the end of its useful life.
Now, as part of a good asset management procurement,
you can't just go out and buy a device off the shelf
and hook it up to the network.
Instead, you always need
to use the proper change management procedures.
By going through the right change procedures,
you can request to be able to buy a new or upgraded asset
and then be able to put that onto the network.
When you put in that change request, it's going to be assessed
to verify any impacts to the business operations, networks
and other devices that already exist in the network.
Once the change procedures have been approved,
you move into the next phase
of the lifecycle, which is procurement.
Procurement involves determining a budget for the item
and then identifying a supplier
or vendor who you can buy that asset from.
Once you buy that asset
and you bring it to work, you now move into
the deployment phase.
During deployment, you're going to implement a procedure
for installing that asset in a secure configuration
with a secure baseline on the network.
I can't just go to the store and grab a laptop
and then hook it up to my network
because that would introduce a ton
of vulnerabilities to our network.
So whenever I buy a new device, it needs
to go into the IT department.
They need to make sure it is secure,
that we have a good lockdown
and hardened configuration on it,
and then we can deploy that onto the network.
Once it's been deployed,
we then move into maintenance mode, maintenance mode,
also known as operations
will implement the procedures for monitoring
and supporting the use of that given asset.
And then finally, we get to disposal.
Disposal is where we're going to implement a procedure
for sanitizing any data remnants on that device
and be able to make sure that device can then be reused,
sold, donated, recycled,
or destroyed if we no longer need it.
So in the real world, what does this look like?
Well, let's say I wanted
to buy 20 new computers from my organization.
I'm first going to go through our change procedure process
and say, this is the model we're thinking about.
This is what we want to buy, will you approve it?
Once our IT security team looks at it
and approves it, we would then go
and get the budget from the executive suite
and they would then identify a trusted supplier
and allow us to make that purchase.
Once those 20 new computers arrive, we're going to give them
to the IT administrators who are going to go through
and install the right operating system, configurations
and applications for our organization.
They will then put those out
and deploy them onto all of our desks.
And then we are now in maintenance mode.
At this point, our IT folks are going to be responsible
for implementing procedures to monitor
and support those assets during their useful lifecycle.
Normally, this will be anywhere from two to five years,
depending on your organization.
At the end of that time,
those computers are no longer useful, they're too old,
they're too slow, they're too vulnerable, whatever it is,
we're going to then replace them
by implementing a new change procedure
to bring in a new asset,
and then we'll take the old assets away
and we will then destroy those assets either
by using electronic sanitization of the data so we can reuse
or resell those hard drives and assets,
or we'll remove those hard drives
and physically destroy them,
and then sell the remaining pieces of hardware
or give them to some other kind of organization
that might be able to use them.
And that's the way we work through
our asset procurement lifecycle.
From change approval to procurement, to deployment,
to maintenance to disposal.
Next, we need to talk about warranty and licensing.
Every asset you buy is going to come
with some kind of warranty.
Some are very short and some are very long.
For example, if you buy a new Apple computer,
they usually come with a 90 day warranty.
After 90 days, it's up to you to solve any problems
that happen with that device
unless you bought an extended warranty.
If you bought an extended warranty,
that should also be notated inside
of your asset management database.
And that way inside the asset management database,
you could look at each asset record based on the asset ID
or asset tag and identify is it under warranty
and how much warranty is left.
In addition to having the proper warranty
and support contracts in place, you also need
to make sure you have the right licensing in place.
Most pieces of software are going to be commercially procured
pieces of software, and they require you
to have a license in order to use them.
So for example, on my system,
I use programs like Microsoft Office,
and so I have a license associated with this asset
that allows me to install Microsoft Office on this computer.
That doesn't mean I can install it on all 20 new machines
I just bought 'cause I only purchased one license.
So you have to keep track of your licensing
and make sure that all of your licenses are valid
across all of your devices.
Now, the other important thing here
is to determine which assets need which pieces of software,
and therefore you can buy licenses
just for the software you need for those devices.
A good example of that is in my organization,
part of my team are video editors
and the video editors need
to use a very expensive video editing software.
I don't need that for every employee in my organization,
but I do need it for the three to five people
that work in the video production department.
And so for those folks, we pay for that software,
we license it, and we install it on their computers.
Alternatively, my web development team has other software
that only they use, and so we purchase licenses
and we track those in our asset management database
for their particular systems
to make sure they have the software
and licensing they need on those systems.
The final thing we need to talk about when it comes
to asset management
is how you're going to make sure you identify
which user is assigned to which asset.
Now, every organization does this a little bit differently
depending on the way your organization is set up.
For example, in one of the large organizations
I used to work in,
each user was actually assigned four different devices
when they got hired and started working there.
The first one was an unclassified computer,
the second was a classified computer.
The third was a top secret computer,
and the fourth was their phone line.
Each of those things were assigned directly to that user.
And inside of our asset management database,
you could see exactly which user was assigned
to which device at which location.
Anytime you move desks
or move offices, you'd have to turn that equipment back in,
and then you get assigned new equipment at your new office.
And this way they could track exactly which hardware assets
were assigned to which users.
But most of the time in commercial organizations,
I only see people assigning hardware assets
to users when it comes to things
that are going to go home with them.
Things like laptops, tablets, and mobile phones.
When it comes to their desktop computer in their office,
generally they're not going to assign that to a specific user,
and instead they'll assign it to the office
or the desk itself.
But again, this is something that is going to vary depending on
where you work and how your organization is built.
If you're working at a large call center, for example,
the workstation on your desk, may be a shared use asset
because you're running 24 hour operations
and you're only sitting at that particular desk
and that workstation eight hours a day, five days a week.
And so there may be five other people who are sharing
that same computer depending on their work schedule
and the time of day or day of the week
that they're working and using it.
So it's important to keep this in mind as well
as you think about who is being assigned,
which devices in terms of your asset management.
And all of this should be documented back
into your asset management database
by using those asset tags
and asset IDs for each individual workstation, computer,
smartphone, tablet, switch, router,
or other device that's being tracked in your organization.