Asset management is a foundational IT service that many organizations continue to struggle to provide.\u00a0 Worse yet, and from the security perspective, this affects all of the secondary and tertiary services that rely on this foundation such as vulnerability management, security monitoring, analysis, and response to name a few.\u00a0 While it is very rare that an organization has an up-to-date or accurate picture of all of their IT assets, it is even rarer (think rainbow-colored unicorn that pukes Skittles) that an organization has an accurate picture of the criticality of their assets.\u00a0 While some do a decent job when standing up a CMDB of mapping applications to supporting infrastructure and ranking their criticality (although many tend to use a binary critical\/not critical ranking), these criticality rankings are statically assigned and if not updated over time may turn stale.\u00a0 Manual re-evaluation of assets and applications in a CMDB is a time-consuming task that many organizations, after the pain of setting up the CMDB in the first iteration, are not willing or likely to make re-certification of assets and criticality rakings a priority\u2026and it is easy to understand why.\u00a0 My other issue is that many CMDBs sometimes take into account the \u201cavailability\u201d factor of an asset over the criticality of the assets from a security perspective.\u00a0 For example, it is not uncommon to see a rigorous change management process for assets in the CMDB with a slightly less rigorous (or non-existent) change management process for non-CMDB assets.\u00a0 But I digress\u2026to summarize my problem:<\/p>\n
The impact of inaccurate asset inventories and lack of up-to-date criticality rankings got me thinking that there has to be a better way.\u00a0 Being that I spend a majority of my time in the security monitoring space, and now what seems to be threat intel and security\/data analytics space, I kept thinking of possible solutions.\u00a0 The one factor I found to be in common with every possible solution was data.\u00a0 And why not?\u00a0 We used to talk about the problems of \u201ctoo much data\u201d and how we were drowning in it\u2026so why not use it to infer the critically of assets and to update their critically in an automated fashion.\u00a0 Basically, make the data work for us for a change.<\/p>\n
To start I looked for existing solutions but couldn\u2019t find one.\u00a0 Yes, some vendors have pieces of what I was looking for (i.e. identity analytics), but no one vendor had a solution that fit my needs.\u00a0 In general, my thought process was:<\/p>\n