|
When businesses and governmental agencies direct their IT organizations to establish a practice of software license management to meet compliance standards and minimize the risk of external audit, IT leaders seek technology designed and provided by commercial vendors. The expectations are seemingly straightforward; deliver software license management functionality that supports:
- Identifying installed software products
- Matching installed software products to existing software licenses
- Reporting compliance status
It sounds simple enough. In fact, products offering this type of functionality have been available for many years. Why then are so many organizations struggling to address the relationship between software and license, achieve desired levels of compliance and avoid audits? The unfortunate truth is that despite nearly two decades of development, the capabilities available in many commercial software inventory tools boil down to “educated guesses” at best. The root of the problem lies in the fact that there is no single set of standards outlining how products are to be internally or externally documented, or manufactured for sale and installation.
Even though many operating systems offer file attributes, not all software publishers take advantage of these features. In the event that software offerings do include the pertinent attributes, a lack of formal quality assurance conventions significantly lessens consistency. In fact, there are documented instances where industry-leading vendors have brought products to market with their company name misspelled.
Aside from the inconsistent and incomplete publisher and product names, version, edition and language data is often published without a common format, and in some cases, simply missing altogether.
EVALUATIONS AND BUNDLING
Further complicating software inventory processes are the practices of evaluations and bundling.
Some time ago, the idea of “try before you buy” was limited to shareware vendors using evaluations as an inexpensive marketing tool leveraging the capabilities of the fledgling Internet. Today, with the exception of enterprise and specialized vertical solutions, nearly every major software publisher makes most, if not all, of its portfolio available for download and time-restricted trial periods. Unfortunately, these publishers rarely include notations in the registry entries or file attributes that indicate the software is an evaluation copy. Bundling — the process of combining software developed by two or more publishers in a single product — is a common practice when releasing software that supports non-core or “commoditized” functionality, such as reporting, database and Web services. Again, publishers rarely change anything in the registry entries or file attributes to indicate that the software is bundled.
Due to a lack of proper registry entries or file attributes, software inventory tools typically cannot recognize software installed for evaluation or differentiate bundles from full products requiring an associated license. As a result, the reported software inventory is artificially inflated to contain items for which users can rarely prove entitlement.
Compounded Difficulties
The vagaries of software product data aside, it would seem that in such a mature product market, all automated inventory tools would deliver essentially the same results. Unfortunately, differences in the areas of data collection and product recognition have eliminated any effective standardization.
Data collection can be approached in several ways, depending on the overall product design and the platform being inventoried. The traditional collection method requires installation of client software, often called an agent, though network-based interrogation and other agent-less methods are approaching equivalency. Once installed, an agent examines the software for all registry entries, file attributes and any product identification data embedded in the code to produce an inventory.
Recognition is then employed to identify the software product for which data was collected. The prevailing method of product recognition utilizes what are commonly referred to as “signatures” — content created for the sole purpose of using multiple data points to accurately identify software products. Signatures typically contain functionality for cleansing and normalization, though some tools include richer feature sets designed to associate the software inventory to various categories, such as functional, licensable/non-licensable, freeware, open source and more.
Done well, comprehensive signature-based product recognition can deliver a software inventory with a high degree of accuracy. However, achieving a comprehensive inventory depends entirely upon the library of available signatures.
|
