Mastering CMDB data integrity with authoritative sources
One of the things you can do is you can use different sources of authority of information. You think about an IT landscape. You've got endpoints. You've got virtual platforms, right? We'll call them servers. At this point, we've got virtual appliances. You've got ingress and egress points. Each one of those will have a different source of authority. Just take a look at, for instance, all of your endpoints, right? One of the—in fact, we've had organizations actually go back to finance because you— think about it: Finance knows whether they understand the data or not. No knock on finance people, of course, is they can tell you how much money you spent on endpoints. How many laptops did this company or organization buy in the last two years? Okay, you take that list and then you say, “How many can I actually see? Where are they? Do I have all of them accounted for? Do I have more laptops, or do I have more endpoints connected to my environment than we've actually purchased?” That's even the worst answer, right? How many of those endpoints do you not even know about, or you didn't—you don't even know. That is, that's the kind of thing where you say, “Okay, find the authoritative source. How many should we have?” And then you have to go to your environment and say, “Okay, how many do we have?” Now there's different ways to balance those two. You can use different scanning tools. You can use vulnerability management scanning tools. You can use different network scanning tools. You can also, obviously, use ServiceNow's discovery capability. You instrument that, and that thing works fantastic. It finds—it flips over all the rocks and looks under the couch cushions and all that, and it'll find what you have. Again, authoritative sources. Balance that against your actual scans of what you find, and then see if there's a delta, and there typically is.
https://www.youtube.com/watch?v=opHT9ts5rSE