Imagine the CIO of a consumer bank who thinks he is running 50 Oracle databases, but now finds out that in fact he has 100 databases installed behind his firewall. He doesn't have any idea where the other 50 came from. He doesn't know the name of the vendor(s) supporting them. And he doesn't have anyone on his IT team assigned to managing them. This scenario would be totally unacceptable to anyone.

That CIO would be shocked to hear that a very similar situation is happening today. But it's not undocumented databases that will surprise him. It is undocumented open source software embedded inside externally facing web and software applications.

Spend Small, Think Small
Often times the philosophy of "spend small, think small" prevails for most IT organizations. Unless an organization is adopting a large open source project such as Linux, special resources are not being allotted to the management of open source adoption.

In the past, if developers wanted to incorporate third-party code into their applications, a joint development agreement or in-bound licensing contract would be negotiated. The process would have also included a development manager, procurement lead, and a lawyer.

Today's software development world is complex and fast-paced. Software engineers are under increasing pressure to deliver large, high-quality applications in less time, with fewer resources. As a result, the use of community-based open source software components has become one of the most dominant trends in software development.

To remain competitive, complexity and weighty processes have dropped by the wayside, with many disappearing altogether. In today's world of 24/7 and persistent network access, developers dispersed across multi-national sites can include open source, freeware, public domain, evalware (demos of commercial software), etc., into the code they are writing without triggering the usual checkpoints in the procurement process. Without these controls, the open source software is unlikely to be detected, monitored, and tracked.

As a result, IT organizations are unaware of what exactly comprises their code base.