Asset Inventory

This chapter is about asset inventory. In order to know what to protect, you have to understand what assets you have whether they are software, hardware, or ephemeral. Asset inventory is foundational in a cyber-resilient organization. The reality is an asset inventory tends to be an afterthought. You need a good asset inventory so that you know what is on your network, whether on-premise or in the cloud.

In this chapter, we’re going to cover the following main topics:

• Asset inventory
• Change management
• Mobile device management (MDM)
• Knowing your network

Asset inventory

An asset inventory is a listing of software and hardware assets at your company. It can be as simple as a spreadsheet with the software versions, hardware with serial numbers, and an asset owner. Who wants to have to manually keep up with this information? You will definitely want to use a product to help with keeping an accurate list of your company’s assets. Having a good asset inventory will enable you to do the following:

• Quickly search the assets you own and figure out if a CVE applies to your company
• Have asset owners assigned for each hardware asset
• Understand if an unauthorized asset is on your network

An asset inventory is mandatory for all compliance. Many times, companies don’t get serious about their asset inventory until it is time for the company to be compliant, whether it’s SOC 2, ISO 27001, or HIPAA. See Table 9.1 to see a mapping of asset inventory to various compliance standards and frameworks:

...

Change management

Change management is ensuring all changes to your IT environment are managed, approved, and documented throughout the entire process. This ensures orderly software and hardware changes are made in your environment. When I worked at IBM in the 1990s, I was part of the Network Team supporting the IBM Southeast Geoplex. I really learned about the change management process while at IBM. I was mentored by two different people on changes who each had their own way of performing changes. The first person who trained me on doing changes would put in a ticket, get approval, and then we would show up during the change window and figure out and make the change. You don’t want to do this. The second person I worked with had a very different and much better approach. Of course, we would enter a ticket into the ITSM system. We would get approval to do the change during off hours. We would send out an email notification related to the change to potentially affected users...

Mobile device management (MDM)

As part of your asset management strategy, you need to consider managing mobile devices. If you are a small company, a cost-effective way to do this is to use Apple’s Business Essentials for small businesses if your organization uses Apple products.

Microsoft’s Intune is great for asset management and mobile device management and also will manage Apple and Android devices.

A more traditional means of managing mobile devices is to use network access control (NAC). When I worked at Cisco, they used NAC for MDM. If you tried to connect to the Cisco internal network with your own device, it would automatically be put on the guest network. As for Internet of Things (IoT) devices, these should be on separate network segments since they are easily hackable and not internet-facing.

Knowing your network

It’s important to have visibility into your network. Understanding where devices sit, whether on the internet, several hops into your network, or even in a lab, is important. Understanding your network and where assets reside is important, especially to your vulnerability prioritization plan. Many companies have network diagrams, but having a tool that will give you an actual view of your network is super valuable, whether it is on-premise, hybrid, or in the cloud. There are visibility tools such as Datadog, Dynatrace, and New Relic that will map your network automatically. For the cloud, each service offers its own tools for asset discovery and inventory, including visualization of your assets. There are separate tools that will provide visibility into multi-cloud environments that combine multiple features into one product. CloudWize, Wiz, and RedSeal provide multi-cloud visibility with vulnerability and attack vectors. Wiz is the dominant leader in the...

Summary

In summary, having a good asset inventory is critical in building your security program. It is usually step 1 in frameworks, but in reality, it becomes an afterthought. Whether you use a tool such as Jira, ManageEngine, ServiceNow, or even a simple spreadsheet, you need to maintain an asset inventory. As part of establishing an asset inventory, a change management plan and processes should be used, as well as developing a configuration baseline.

In the next chapter, we will be covering data protection. The most important action every CISO must take is to encrypt your company’s data, whether in transit or at rest.