Intro

Hello travelers, and welcome to adventures in security. Our IT assets are important to our businesses, supporting all critical business tasks. They also contain data that we don't want threat actors of any kind to access. In this video, I take a quick look at the overall IT asset life cycle, and then I focus on how to manage each asset while in operation. The management approach is known as ITAM or IT asset management. The script for this video, formatted as a study guide, is available for download from above or at the end of the video.

General Asset Lifecycle

Every asset has a life cycle as shown here. The life cycle starts with defining a need, moves to planning and design, and then the system is implemented on-premise or by a cloud service provider. During operation, IT takes steps to maintain the system and manage changes. Finally, the system is retired and the associated media sanitized. The rest of this video looks at the operate, maintain, and modify phases, phases that are really a sub-cycle within the larger life cycle. For a more detailed look at the entire life cycle, download NIST SP 1800-5 from above. This document is also the basis for the ITAM information in this video. Another life cycle is associated with DevSecOps. ITAM focuses on the deploy, operate, and monitor stages. Operational management, including patching and change management, requires security oversight, but security should be built into every life cycle activity.

ITAM Model

This is the NIST SP 1800-5 ITAM model, consisting of multiple tiers and input processes. Let's quickly step through them. As with all security efforts, ITAM is controlled by governance, governance provided by management oversight and expectation setting. Governance includes development of policies that define management's expectations for achieving regulatory and risk management objectives. Starting at the bottom of the model, we see enterprise assets, assets that should have been inventoried, classified, and categorized. Assets include software, hardware, and firmware. For an explanation of asset classification and categorization, watch my video above. Tier 2 collects information for analysis. To effectively support ITAM, organizations should record asset information in a central location, such as a configuration management database, that provides a clear picture of configuration identification of an asset along with its cross-operability with other systems, its classification, and its categorization. Configuration control, including asset builds, patch levels, licensing changes, and recovery processes. Status accounting and control, including all modifications throughout the asset's lifecycle, verification and audit, including audit results, known vulnerabilities and status, and missed configuration updates. When implementing an asset into an ITAM environment, it must be able to communicate to Tier 2 by a vendor-supplied agent, API, or other means. An organization should allow no changes to an asset unless that change passes through a change management process, a process like the one described in the video at the link above. The change management process must include integration into the ITAM environment and relevant updates to the asset inventory. Tier 2 also collects real-time information about each asset and the operational environment where it lives, including IPS/IDS activity and continued operation, both host and network. Anti-malware update levels, activity, and continued operation. Firewall activity and continued operation, both host and network. List of all installed applications, with flags placed on discovered applications not found on the organization's approved application list. And asset and user behavior. Tier 1 further analyzes and correlates the information collected and stored by Tier 2, providing access to analysis results via a portal. This analysis begins with at least a SIEM solution, improves significantly with an entity behavior analytics solution, and achieves major ITAM objectives when extended with APIs and human analysis to integrate all leftover pieces of ITAM operational data. The problem with ITAM today, at least as described by NIST, is a lack of a single solution that brings all of this together, together into a set of solutions that enable asset management monitoring and response. NIST SP 1800-5 provides a detailed look at proof-of-concept configurations together with multiple available products that can be used together. These products enable implementation of a comprehensive ITAM environment. Note that asset management provides physical security of assets as well. I provide a series of videos on physical security at the link above. That's it for this video. If you have questions, please ask, and if this information was helpful, please subscribe. ...and until next time be careful what you click.