CD-SEC-09 - Asset Management Failures
Apps are trivially easy to create and just as easy to forget, creating orphaned, business-critical dependencies.
Intent & Description
'
🎯 Intent
Prevent the proliferation of orphaned, unmanaged, and forgotten citizen development applications.
📋 Context
Apps are trivially easy to create and just as easy to forget. What starts as a personal productivity tool quietly becomes a widely shared, business-critical dependency with no designated owner, no patching cadence, and no SLA — and the sheer volume makes a manual inventory effectively impossible.
💡 Solution
Implement centralized governance/inventory of all citizen-built apps, components, and their owners. Enforce ownership and lifecycle policies. Create tiered risk classification (an internal read-only dashboard is not the same risk class as a customer-facing data pipeline). Schedule removal of unused apps and dependencies. Implement automated discovery mechanisms.'
Real-world Use Case
Source
📌 TL;DR
Implement centralized asset management. Inventory all apps, enforce ownership policies, classify by risk, and remove orphaned dependencies.
Advantages
- Enables comprehensive inventory
- Prevents orphaned applications
- Supports lifecycle management
- Improves governance visibility
Disadvantages
- Inventory maintenance overhead
- Automated discovery complexity
- May require platform integration