Chapter 2 - Inventory and Exposure of Corporate Assets

Abstract

Inventory and corporate assets to any complete security lifecycle as they help identify host and network changes could increase the risk of exploitation for the servers. It is recommended that one scans in and out of the networks on a semiregular basis to assess exposure. One needs to assess the output for exposures as well as unauthorized host and network devices. There are a number of free tools and commercial tools out there that can be used effectively to take a snapshot the internal network. The real problem is mapping the massive amount of data produced from these tools into a format that allows for retention, analysis, and updates, yet still be current when it is needed. Tool without an effective process for usage and data evaluation is of little value managing something as massive as network inventory. A process should be developed that is realistic for a network of the size and be sure it is repeated on a regular basis. Also, a clear and documented understanding of the internal network's assets is an important part of understanding risk.