A friend came to me with a delima. A company is replacing all PC's within the organization. They are looking at buying laptops, desktops and VDI terminals. They are also using this as an opportunity to ensure that they have all the security software that they need on the systems to provide the most protections. They are looking at things such as AV, DLP, Encryption, HIPS, etc... One of the guys on the team decided that they needed phone home software to help in recovery of lost or stolen devices. Actually he says that it's pretty handy software. It has the ability to do much more than just phone home. It takes inventory of all software on the machine, alerts you when new software is installed, gives you asset management capabilities, can reinstall itself if the software gets removed, and lots more. They are considering installing this on all systems because a few desktops have gone missing. When asked how many and over how long a period of time no one was able to give an answer. Yet they are willing to invest thousands of dollars in this software that will really not give them anything that they don't already have except the phone home capability. So why the big rush to buy something that isn't needed?
There are several questions that need to be asked and answered before a purchase such as this can be justified in my mind.
- Just how many systems do actually go missing every year?
- Are they really missing or are they just not being tracked properly as they are moved, replaced, etc?
- How many systems can they afford to lose per year before they actually see any real value in this program?
- Can they replace any other applications with this software? Asset tracking, System Monitoring, etc
- How much of an investment in infrastructure and personnel resources will be required to manage this program.
