If you’re responsible for managing, securing, tracking, or even monitoring assets, you’ve probably come across your fair share of challenges.
Modern asset management is the kind of task that’s so fundamental, so theoretically simple, and yet so frustratingly difficult that it makes you wish we never evolved beyond the clunky desktops of the 90s.
The good news? You’re not alone.
Even better? There are solutions to those challenges.
Analyzing Data from Security Professionals
To assess just what cybersecurity professionals struggle with when it comes to asset management challenges, we talked to our customers.
These real-life scenarios cut across different industries and company sizes, so they’re strong use cases to dissect and learn from.
We found four key challenges that came up time and again:
- Aggregating asset data from many sources
- Finding unmanaged devices
- Real-time inventorying at massive scale
- Testing compliance
When you combine those with recent trends — emerging technology, like IoT deployments or the rise of cloud assets, and BYOD — it’s clear that asset management challenges for cybersecurity aren’t going away anytime soon.
The bottom line?
Many of these challenges build on each other, so if you can solve the first couple, the rest will start to fall into place.
The Top 4 Asset Management Challenges For Cybersecurity
1. Aggregating Data
To have visibility into your environment, you need to pull data about your assets from every possible source. Of course, with an average of 108 security tools, that’s easier said than done.
Still, it’s an essential step. It’s the foundation for how you’ll solve every other challenge discussed below.
How to Solve It
When it comes to aggregating data, almost every tool that knows about an asset has an API. For example, Axonius can gather detailed asset information because the solution integrates with over 250 security and management tools that have published APIs. Whether you decide to use a product or want to do your own data aggregation, the APIs are available for almost any tool that knows about assets.
2. Finding Unmanaged Devices
It’s a topic near and dear to our hearts: unmanaged device discovery is critical to asset management.
In this context, we’re defining unmanaged devices as those that aren’t known to a management system and do not have a security agent installed.
An unmanaged device can be as innocuous as a webcam, or as significant as an unpatched Raspberry Pi connected to a production network.
How to Solve It
To discover which devices are unmanaged, you’ll need to gather data from the network (solutions like network management consoles and VA scanners) as well as data from agent-based solutions.
This will help you understand which devices are network-connected and which are covered by agents. Only then can you identify the delta: devices that are present, but not managed.
3. Inventorying at Scale
For enterprises, inventorying all assets is a major issue.
Standard device inventories alone present significant challenges, let alone inventories of newer assets like cloud instances or IoT devices. It’s the culmination of the first two cybersecurity asset management challenges: you need to pull data on all managed and unmanaged devices.
The biggest problem? While this can be done, it takes a really long time. We’re talking 80+ man-hours — and even then, it gets out of date pretty quickly.
How to Solve It
To address issues of scale, it’s important to have customizable data aggregation frequency per data source.
For example, asking Active Directory to give real-time updates is a terrible idea (at least it is if you care about performance!), but getting asset data from a public cloud provider like AWS or Azure should be as close to real-time as possible.
Ultimately, scaling an asset inventory must accommodate the downstream impact of the source.
4. Testing Compliance
Without that comprehensive inventory, it’s impossible to understand whether all assets adhere to or deviate from compliance requirements.
And without the ability to constantly monitor and validate how dynamic changes to the environment relate to compliance, point-in-time compliance checks become immediately obsolete.
How to Solve It
Though an oversimplification, understanding each compliance requirement and being able to see exactly how every device, user, and security control map to what’s mandated is the only way to test adherence.
For example, companies with a heavy public cloud footprint may choose to use the CIS Benchmarks to evaluate whether all cloud instances match industry best practices for security.
For end user devices, organizations might use the CIS 20, NIST, or industry-specific regulations like HIPAA, PCI, or others to determine whether assets are compliant.
Solving Cybersecurity Asset Management Challenges
Solving these cybersecurity asset management challenges starts with aggregating data, discovering which devices are unmanaged, having an accurate inventory, and understanding how every asset relates to compliance.
Whether you can do this through a cybersecurity asset management platform or you’re forced to do it yourself, all of the information is out there. It’s just a matter of being able to bring it all together, understand how every asset relates to security controls, and understand every time changes occur.
Get the full picture on the best solutions for each individual challenge, as well as the tools that can make each solution easier. Check out Axonius’ recent white paper here.
Nathan Burke is the Chief Marketing Officer at Axonius. Passionate about bringing new technologies to market to solve real problems, he has held marketing leadership roles at Hexadite (acquired by Microsoft), Intralinks, MineralTree, CloudLock (acquired by Cisco), and is a frequent speaker and contributing author on topics related to the intersection of collaboration and security.