Asset Management

In today’s world, where cybercrime is on the rise and data breaches are a common occurrence, protecting your data can be a complex task.

It’s critical for organisations to understand how data is being accessed, whether the access is through secure mechanisms, and how to control that access. You can’t control or protect what you can’t see. Which is where asset management comes in.

 

What is asset management?

Asset management is one of the most crucial elements of protecting data, as it helps identify all devices connected to an environment, manage their level of access, and establish business processes to record new devices.

The main goal of asset management is to ensure that an organisation’s assets are being used effectively and efficiently while minimizing security risks and ensuring regulatory compliance.

 

Why do we need asset management? 

Our business data is now the primary target of most cyber criminals, they know our businesses need that data to operate, transact business and ultimately to do what we do. Protecting data should be a priority for any organisation and one of the most important elements to protecting our data is understanding how it is being accessed. Every mechanism that can be used to access that data is a potential risk.

So, we need to make sure that we have a clear understanding of what is or can access the data, is it a secure mechanism, and how we can control it?  

It’s important to note that asset management is not just about device management as we’ll come onto later, but device management is a key part of it and can do most of the leg work needed for effective asset management so let’s start there. 

 

Device discovery 

In larger environments or environments where the non-Enterprise Mobility Management capable device change or move around a lot, it may be necessary to utilise a product such as Forescout suite to identify all devices connected to your environment, the results of this can then be taken even further to manage the level of access they have using Network Access Control and Network Segmentation to restrict access of devices you have not authorised pending identification and authorisation. 

 

Integrate asset management into your organisation 

Implementing an Enterprise Mobility Management (EMM) solution for your organisation can provide several benefits. Firstly, it enables you to adopt efficient deployment practices whereby new devices are automatically enrolled into your EMM solution. This ensures that policies, restrictions, and software are automatically deployed onto the devices, resulting in a streamlined process. Furthermore, the devices will automatically report their status, allowing you to apply any new policies as needed.

To ensure that new devices are introduced to the environment in a controlled manner, it’s crucial to establish proper business processes. This includes recording new devices in your asset register, which ensures that the register accurately represents the devices in use. Whether you decide to include devices managed by your EMM in your asset register is a business decision. However, it’s worth noting that EMM solutions may facilitate integration, allowing details of the devices in the EMM or device discovery/control software to be replicated into your asset register.

 

What to do with your asset information? 

Identify who is responsible for what 

In many cases environments can sprawl over time and who is responsible which system can become clouded. This can mean making changes or troubleshooting is much more time consuming than it needs to be. With a detailed view of the assets in the environment to use, it is clear where responsibility lies and this can help improve efficiency. 

 

Identify business critical areas 

Once you have a realistic picture of all the devices that make up your estate, identify those which are delivering or associated with critical business services, consider any dependencies they have, and then use that as to build a picture of the areas in your infrastructure that are most important to your business. 

Bear in mind that data is also an asset; one that may not all reside on-premise or may be stored on removable media. Having a robust backup strategy in place that adheres to industry best practices and is tested regularly will ensure that your data will reliably be there when you need it. 

 

Identify areas of vulnerability 

The asset information that you have will also help you to categorise areas that may represent more significant concerns from a security perspective – unsupported operating systems have become a problem for many organisations in recent years, servers hosting business critical applications or services that cannot be migrated to newer versions is one of the most common problems.  

An area of common vulnerability in most environments is the ability for unmanaged endpoints, laptops in particular, to be physically connected to a network port in the office and granted access to production systems. Hackers can easily breach account credentials or find ways around them, preventing them from being able to access anything needs to be a priority in any business. 

Users can be one of your strongest lines of defence against cyber threats, or they can be your greatest weakness. Cyber criminals research their targets and they use the intelligence gathered to fabricate extremely convincing social engineering campaigns. Don’t make it easy for them to do that. A robust cyber security training and engagement strategy is essential for any organisation.

 

Remove what you don’t need 

Sounds obvious, but sometimes as environments sprawl out of control and increase in complexity there can be uncertainty about exactly what a particular server does, and rather than risk an outage these devices can linger well beyond the end of their life unnecessarily.  

Using the asset register and the allocation of responsibility for each device should enable extant devices to be identified and decommissioned. 

 

Maintain and improve your asset management 

After putting lots of time and effort into building your asset management system, it is easy to let it atrophy and become out of date, always look at automated ways to ensure the information held is being actively updated so you have a high degree of confidence that what you are looking at is representative of what you have today.

 

In Conclusion

Protecting data should be a priority for any organisation, and asset management is one of the most critical elements of safeguarding against cybercrime and data breaches.

With a clear understanding of what devices can access the data, businesses can identify areas of vulnerability and business-critical areas, allocate responsibility for each device, and remove what is no longer needed.

Maintaining and improving asset management is an ongoing process, and businesses must continually monitor their environment to ensure their assets are being used effectively and efficiently, with minimized security risks.

–

If you haven’t done so already, our Posture Assessment tool is a quick-and-easy way to identify your strengths and weaknesses, and get a better picture of your overall security posture. 

We have put together a page of recommendations for improving your Asset Management, and which tools can help, which you can read here.