{"id":65761,"date":"2023-04-17T11:52:55","date_gmt":"2023-04-17T03:52:55","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=65761"},"modified":"2024-09-13T16:31:21","modified_gmt":"2024-09-13T08:31:21","slug":"asset-inventory-is-foundational-to-security-programs","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2023\/04\/asset-inventory-is-foundational-to-security-programs\/","title":{"rendered":"Asset inventory is foundational to security programs"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Think of the technological ecosystem an organization relies on to operate efficiently and effectively: desktop workstations, mobile devices, IT\/IoT\/OT devices, virtual systems, web apps, data, cloud infrastructure\u2013just to name a few. Keeping track of every single one of these devices feels impossible.<\/p>

As the number and types of assets continue to grow exponentially, organizations need help staying on top of these devices. Left unmanaged, these devices can act as potential footholds for malicious actors. Security teams need to be able to discover and identify unmanaged assets<\/a> if they ever want to secure or protect them. How could they effectively secure and protect their organization if there are assets they don\u2019t know about\u2013what they do, where they are, or what their status is?<\/p>

<\/p>

\u00a0<\/p>

Cybersecurity frameworks and regulations start with a comprehensive asset inventory <\/i><\/h2>

Asset inventory is the foundation of a strong cybersecurity posture<\/strong>. It is often considered the first step in identifying potential risks to your organization\u2019s security. This is why it is a key recommendation in many cybersecurity frameworks, including the NIST Cybersecurity Framework (CSF) and CIS Controls. By maintaining an up-to-date inventory of all hardware, software, users, and digital assets across your organization, you can better understand your attack surface and take proactive measures to protect against potential threats.<\/p>

Let\u2019s take a look at some of the major frameworks and regulations that require an asset inventory.<\/p>

CIS Controls <\/i><\/h3>

The Center for Internet Security (CIS) provides a list of recognized standards for defending your systems and data against modern cyber threats. Cybersecurity professionals and subject matter experts use a consensus-based process to establish these controls. Organizations such as ISC2 and the SANS Institute contribute to the process.<\/p>

You can consider the CIS Controls<\/a> an essential safety check that ensures you have your house in order by following security best practices. It speaks volumes that the first control on the list, seen as foundational for good cyber hygiene, is \u201cInventory and Control of Enterprise Assets.\u201d The rationale is that you need an up-to-date inventory to know what to monitor and protect within the enterprise. An asset inventory also helps you identify unauthorized and unmanaged assets to remove or remediate.<\/p>

NIST CSF <\/i><\/h3>

The NIST Cybersecurity Framework (NIST CSF) is a set of cybersecurity guidelines developed by a non-regulatory agency of the United States government. The NIST CSF<\/a> is about guidance and best practices with a framework centered around five core functions: Identify, Protect, Detect, Respond, and Recover.<\/p>

It\u2019s in the Identify<\/a> function of this framework that asset inventories get flagged as vital for modern cybersecurity programs. According to the framework, the Identify function is all about \u201crisk to systems, people, assets, data, and capabilities.\u201d A big part of this is knowing what assets you actually have.<\/p>

SOC2 <\/i><\/h3>

SOC2 is a voluntary compliance standard, but it\u2019s often required to land vendor contracts, particularly with SaaS and B2B companies. Compliance with SOC2 shows clients and partners that your company maintains the highest standards of information security. Meeting SOC2 requirements can make all the difference in whether you succeed in various industries and types of services.<\/p>

Effective IT asset management is pivotal for obtaining SOC2 certification. In particular, the certification looks for your ability to safeguard assets against unauthorized access and reliably assign owners and users to assets.<\/p>

HIPAA <\/i><\/h3>

Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is essential in the healthcare industry. High standards of security must protect sensitive patient healthcare information. Violations of HIPAA are costly from a financial standpoint, and the penalty involved depends on the level of negligence.<\/p>

Healthcare providers and business associates need IT asset inventories in order to track the location of electronic health information (ePHI). This reliable, up-to-date asset inventory helps comply with the regulation\u2019s Security Rule<\/a>.<\/p>

PCI DSS <\/i><\/h3>

The Payment Card Industry Data Security Standard (PCI DSS) is a mandatory regulation aimed at protecting cardholder data. Companies that store, process, or transmit cardholder data must comply with PCI DSS. In requirement 2.4 of PCI DSS, the regulation requires companies to maintain an inventory of physical devices, software, user accounts, and more.<\/p>

The elusive single-source-of-truth for assets <\/i><\/h2>

An asset inventory is like the blueprint of a house\u2013without it, there isn\u2019t a clear understanding of what needs protecting. But just like how blueprints can change over time with additions and renovations, an inventory can also become outdated as assets get added or removed from the network.<\/p>

Networks change constantly, with users logging into enterprise platforms from personal devices or rapidly spinning up new cloud infrastructure that often gets forgotten about. Unsanctioned shadow applications get stood up or accessed by different departments. Add remote work and the continued proliferation of IoT devices to the mix, and you have a more complex IT ecosystem that\u2019s harder to track than ever.<\/p>

A couple of statistics that drive home the challenges include:<\/p>