Application and Software Inventory: How Does It Work?

Most organizations have hardware inventories and understand why they matter. However, it’s also essential not to overlook the importance of application and software inventories.

Why Do Organizations Need an Application and Software Inventory?

As organizations increase their use of software and applications, it can be hard to keep track of what’s in use. But you can’t maintain and manage what you don’t know you have. And improper management can lead to increased costs due to unnecessary or duplicative software or to security issues arising from vulnerabilities and exposures caused by unmanaged software.

A comprehensive application and software inventory—and a consistent process for keeping it current—will help you determine:

• The applications employees are accessing within your organization
• Whether the applications are installed locally or hosted in the cloud
• The data that each software solution and application accesses and stores
• Which applications need patching
• Which software solutions and applications are reaching end of life and need to be updated or replaced
• Whether any unnecessary or unapproved software is installed
• Whether each solution’s employee access is properly secured with password, multi-factor authentication, and account lockout parameters

The following three steps will help your organization create and manage an effective application and software inventory system that contributes to a secure environment.

Step 1: Identify What Software and Applications Are in Use

Begin by determining which systems your employees log into daily. Include software and applications installed locally on workstations and servers, as well as any web-based applications.

To accomplish this:

• Survey the departments within your organization – Ask each department what software and applications they are using, what they use them for, and which employees need access. Remind employees not to forget the sites they use only periodically. Ask them to review their browser bookmarks to remember sites they may only use periodically, such as for quarterly reporting functions.
• Look at web activity reports or employees’ browsing histories – This will show you which sites employees are actually accessing. You will likely discover systems that aren’t on your list.
• Review the applications installed on workstations and servers – This can be done manually or with an automated tool.

This is typically the hardest step in the inventory process, but it’s a vital starting point.

Step 2: Document Your Findings

Document everything you identify in Step 1 in your inventory system, which can be as simple as a spreadsheet or database. To aid in ongoing management, include details such as:

• The name of the application or system
• Vendor information
• License period
• System administrator or owner
• The type of data stored
• Website address

You may also find it beneficial to document additional application control details, such as other authorized administrators, privileged users, and access control requirements or restrictions.

If you uncovered any concerning applications, software, or exceptions during Step 1, document these as well. Exceptions might include software you didn’t know was in use or an outdated application still used for a specific reason, such as a vendor requirement. Implement a policy requiring any exceptions to be approved by the appropriate level of management.

Step 3: Develop Processes and Controls for Ongoing Maintenance

Once you’ve created your application and software inventory, the final step is to develop processes and controls to assist with ongoing management. This is usually easier than creating the inventory, particularly if you’re using automated tools.

To implement effective processes and controls:

• Limit local administrative access. Restricting administrative access rights on local systems reduces the risk of employees installing applications and software on their workstations or laptops.
• Configure web filters. A web filter can be configured to restrict access to unauthorized sites by blocking specific websites or site categories (e.g., gaming, social networking) or to allow access only to authorized websites. The latter approach is typically much more restrictive, and while it is a great control, it can be more difficult to implement and manage. Regardless of the approach, restricting access to specific websites reduces the likelihood that employees can access or install extraneous or unapproved software. This forces end users to contact the IT department to obtain access to an application or site.
• Review web filter activity reports. As noted above, this can help you stay aware of the websites employees are accessing and applications they may be using.
• Check for obsolete or extraneous applications and software. You can use an automated inventorying tool to generate a report of all installations on your workstations, laptops, and servers, or manually inspect systems. An automated tool can make this task more efficient and effective, helping you identify and address vulnerabilities associated with unmanaged, outdated, or obsolete software more quickly. During this step, make sure:
  • No extraneous software is installed,including software that is no longer needed or is unapproved.  
  • No outdated software is installed, and all applications are running current versions. Being proactive about monitoring this can also help you identify software that is nearing end of life.
  • No obsolete software is installed without an approved business exception, such as when a vendor requires the software to ensure their application runs properly in your environment.
• Reassess exceptions annually, at a minimum. For example, if outdated software was previously approved due to a vendor requirement, check with the vendor to see if an updated, more secure version is now available.   

Now that you have a basic understanding of software inventory creation and management, you are ready to conquer this important task. Identifying and properly managing the software and applications in use within your organization will help you implement layered controls and processes to better secure your environment. Reach out to CRI’s cybersecurity advisors for help.