# CD-SEC-09 - Asset Management Failures

> Apps are trivially easy to create and just as easy to forget, creating orphaned, business-critical dependencies.

- **Category**: Owasp Citizen Development
- **Subcategory**: top10
- **Canonical URL**: https://designpattern.fyi/owasp_citizen_development/cdsec09_asset_management_failures/

---

## Description
'**Intent**: Prevent the proliferation of orphaned, unmanaged, and forgotten citizen development applications.

**Context**: Apps are trivially easy to create and just as easy to forget. What starts as a personal productivity tool quietly becomes a widely shared, business-critical dependency with no designated owner, no patching cadence, and no SLA — and the sheer volume makes a manual inventory effectively impossible.

**Solution**: Implement centralized governance/inventory of all citizen-built apps, components, and their owners. Enforce ownership and lifecycle policies. Create tiered risk classification (an internal read-only dashboard is not the same risk class as a customer-facing data pipeline). Schedule removal of unused apps and dependencies. Implement automated discovery mechanisms.'



## Use Cases
Use when managing low-code/no-code platforms, AI coding tools, or AI agents at scale in an organization.





## Trade-offs


### Advantages

- Enables comprehensive inventory

- Prevents orphaned applications

- Supports lifecycle management

- Improves governance visibility




### Considerations & Drawbacks

- Inventory maintenance overhead

- Automated discovery complexity

- May require platform integration







---
**Reference**: [Original Source](https://owasp.org/www-project-citizen-development-top10-security-risks/)