We’re talking here about two kinds of assets. Physical assets are the machines – workstations, servers, network equipment, etc. Virtual assets are what you deploy on these physical assets or use in the cloud – software, virtual machines, operating systems, databases, etc.
Organizations are generally used to inventorying physical hardware, but manufacturing/production operational technology or specialized healthcare devices can be harder to inventory, as these might not be handled by IT teams. Virtual assets can be even harder to track because they can so easily be created, moved, and destroyed.
These gaps in inventory are blind spots – not just because they can’t be seen, but also because they are potential attack vectors. Undocumented assets may inadvertently be left unprotected – no security agents installed, no security patching, and no hardening of their configuration. Detection and response capabilities are slowed down without monitoring, security controls, or endpoint protection in place.
Many organizations think they have good asset management capabilities, only to discover after an incident that this was not the case. Asset management tools can help you understand your system, leading to informed longer-term decisions.
“
When SOCs [security operations centers] receive a suspicious activity alert, they investigate what should be running on that server. Without an inventory, finding the owner and determining whether the activity is malicious can represent precious time lost, especially when newer ransomware variants can encrypt hundreds of thousands of files within minutes.
Karla BallesterosCyber Services Manager
Los Angeles, CA
The information set forth in this document is intended as general risk management information. It is made available with the understanding that Beazley does not render legal services or advice. It should not be construed or relied upon as legal advice and is not intended as a substitute for consultation with counsel. Beazley has not examined and/ or had access to any particular circumstances, needs, contracts and/or operations of any party having access to this document. There may be specific issues under applicable law, or related to the particular circumstances of your contracts or operations, for which you may wish the assistance of counsel. Although reasonable care has been taken in preparing the information set forth in this document, Beazley accepts no responsibility for any errors it may contain or for any losses allegedly attributable to this information.