Few weeks back I was sitting in a change review and somebody asked a fairly simple question about a piece of middleware we were planning to retire.
What breaks if we turn this off?
Room went quiet for a second and then three different people gave three different answers, all somewhat right, all looking at a different part of the same elephant. We did have a diagram for this thing. Was quite a good diagram actually. Was drawn back in 2022 though.
So I got thinking about why this keeps happening and putting some of it down here.
Easy answer is people are lazy with documentation, I don’t think that is really it, or at least that’s not the interesting part of it.
Integrations mostly don’t get built by architects, they get built by delivery teams. A squad needs a feed from HR system into rostering platform, they build it in a sprint, it works, they move on to next story.
Updating architecture register is not part of definition of done for them, and half the time the register lives inside some modelling tool the squad was never even given a licence for. Even when they have one, adding a node properly means learning enough of the modelling language to not get pulled up on it in review later, which is honestly a pretty good way to make sure nobody bothers.
Then there’s the CMDB, which is supposed to be source of truth for all this. Problem with CMDB is it models things, not conversations between things. It will happily tell you that you run SAP and you run Salesforce. Much less likely to tell you there’s a nightly SFTP job pushing a CSV file between the two of them, running under some service account nobody wants to claim ownership of, where the receiving end depends quietly on column order never changing.
That job is not really an asset far as the CMDB is concerned. That job is the reason somebody’s Tuesday goes bad though.
And then the last one, which I think might be the actual real one. Applications have owners. Integrations mostly don’t, because a flow between two systems sits in the gap between two owners, and gaps between owners is where things go stale. Never once seen an org chart with a box on it for “the bit in the middle.”
Where this actually matters
Most of what I do day to day starts with some kind of data flow diagram. Threat modelling needs one to even get going. STRIDE needs a flow to work against. Privacy assessment needs to know where data is actually going, not where it went in 2019. Control mapping against ISM sort of assumes you already know what your systems are and how they’re talking to each other, which is a bigger assumption than it sounds.
So if the input to all of that is a diagram that was accurate eighteen months back, everything downstream of it just quietly inherits that. You end up producing a properly formatted, properly reviewed risk assessment of a system that doesn’t really exist in that shape anymore. Passes review fine. Still wrong though, and that’s the bit that bothers me.
A messy spreadsheet at least looks unreliable. Clean diagram in a board pack doesn’t, and people go make decisions off it.
Blast radius
Question people normally ask about a system is what does it connect to. More useful question is what stops working if this goes away.
Direct dependencies are usually fine, somebody in the room remembers those. Its the second hop and third hop that get you. Reporting layer feeding a dashboard that finance opens on last day of quarter, three steps away from the node you’re about to patch on a Friday afternoon.
To actually answer that the map needs to be something you can walk through, not something you look at on a wall. Those are pretty different things and it stops being an academic difference the first time you need to ask a question the person who originally drew the diagram never thought to ask.
What seems to actually work
Bit wary of being too prescriptive here honestly, I’ve seen places run fine for years off a spreadsheet and a shared drive between three people who all know what’s going on. If that’s working for you it’s working, don’t let anyone including me tell you otherwise.
But few things I keep coming back to. First one is accuracy is mostly a function of how much effort it takes somebody to update it. If updating the map needs a licence and a training course and learning a modelling language, it’s not going to get updated. If it just needs someone adding a row to a CSV, it might. I don’t think anything else you do matters half as much as this one thing does.
Second thing, registers kept only for compliance always drift eventually, and registers people actually open during an incident tend not to, because being wrong hurts the person maintaining it right then and there. If your map isn’t the fastest way to get an answer at 2am it’s going to drift no matter how much governance you wrap round it.
Third one is a bit of a hobby horse for me if I’m honest. Anything mapping your estate probably should be read only against it. Not because it’s a limitation, more because it’s the right posture. A discovery tool with write access is a whole new piece of privileged infrastructure you now have to protect and patch and explain to an auditor eventually, and you got all of that in exchange for a picture really.
Full disclosure
This is something that’s annoyed me long enough that I ended up co founding a product around it, Archimarc (https://archimarc.com), does integration landscape mapping and blast radius tracing. You add your applications and integrations yourself, upload a CSV or enter them in directly, and it builds you a live graph out of that with blast radius tracing on top. Not automated discovery, somebody still has to know what’s in their own estate and put it in.
One thing we were fairly deliberate about though, every application and every integration has to have an owner attached to it. Goes back to that “bit in the middle” problem I was on about earlier. Doesn’t fix the underlying habit of things not getting documented, but it at least means there’s a name attached to the gap instead of nobody. Self hosted if that’s how you want to run it.
So obviously not neutral here and you should read all of the above with that in mind.
If you’ve solved this some other way, especially automated discovery across a properly messy real world estate, would genuinely like to hear how.
Leave a comment