Author: Sean Slattery

In this final installment of Enterprise Asset Management metrics, we're going to connect these with the business, specifically in terms that the business understands.

Let's recap what we're working with:

• % of active vs inactive systems
• % of managed vs unmanaged systems
• % of known vs rogue devices

Ultimately, we're deal with a matter of management or control. If we can manage it, we can manage the risk. These metrics all serve the underlying purpose of maximizing management and minimizing risk,

The traditional and dare I say legacy approach to procurement is to say something like "We need $1M for a network access control system that also means we're going to have to replace all of our network equipment for compatibility" and then you launch into the vendor presentation. The typical executive's eyes are going to go vacant quite quickly!

Instead try something like this: "How much exposure are you, the business, willing to tolerate from unauthorized devices operating on the network?" Their answer may be a resounding none, until they hear that there is a $1M price tag for a completely automated system. They'll likely ask for an alternative proposal. So then you can offer five-day tolerance for $250K. Now there is a clear business decision which can be made.

Assuming they choose the second option, you have a working budget without even needing to explain the tool being used. You might choose to invest in a new asset/patch management tool, a vulnerability management service, and even some training for your staff. What started out as an ask to fix one issue, became a win across multiple areas!

In our next post, we're going to discuss Software Asset Management.

_{Image Source: Adobe Firefly Generative AI}

Now that we have practical set of metrics, how to we obtain them?

• % of active vs inactive systems
• % of managed vs unmanaged systems
• % of known vs rogue devices

For an SMB/SME, there are a few options which, when combined, will provide you with a highly accurate snapshot of your organization.

Starting with user systems, the following tools have valuable data, to be combined to form your basic asset register.

• Active Directory - Everything about domain-joined systems is found somewhere in here.
• Asset/Application Management - Ideally you need a tool that synchronizes automatically with Active Directory both adding new domain-joined systems to management as well as removing recently removed domain-joined systems from management.
• Auditing Log Management - A good tool can identify active vs inactive systems, by collecting network-wide data and by taking cues from Active Directory.
• Endpoint Security - You wouldn't dream of running a system without some sort of managed endpoint security would you? So you should have very high coverage here. Extra points if you automatically synchronize with Active Directory.
• Network Management - A unified network system i.e. a single pane of glass for all switches, firewalls, and wireless is ideal and would allow you to passively monitor everything.
• Vulnerability Management - Scanner(s) are a great way to actively discover what is on your network and explicitly beyond what is expected to be found.

Now let's consider unmanaged systems. Since we have already established that unmanaged systems aren't in Active Directory, you're going to need to leverage your non-AD capabilities such as Network and Vulnerability Management. These two also help with known vs rogue devices. You have probably noted a trend.

For best results:

• Use a combination of active (AD-aware, network scanner) and passive (network management) tools. Leveraging multiple sources for your asset information reduces the risk of a single tool providing inaccurate or incomplete information.
• The appropriate choice of tools provides value beyond their immediate purpose. For example your asset management tool might provide information about network assets and your network management tool might provide information about your systems.

In Part 3, the rubber meets the road where we fully connect the technology dots to the business.

_{Image Source: Adobe Firefly Generative AI}

To kick things off, let's start with a fundamental aspect of cybersecurity, Enterprise Asset Management. We'll keep it simple by initially focusing on our local networks.

How many devices do you have in your organization? Is 100 a good number? Probably not if you're only a five person office. If you have a 100 person office, that number starts to make more sense. But if you have a 1000 person office, 100 managed systems is a little short. If you don't know what's connected to your network, how can you expect to manage and secure them?

For argument's sake, you operate a Windows Active Directory environment, and all user systems are domain-joined so that they can access shared resources. In general terms domain-joined systems are manageable and non-domain systems are not. A managed system has central policies and settings applied, and carry less risk from rogue applications or misuse. Business people understand risk: less risk is good, and more risk is bad.

So the number of domain-joined systems makes sense as a metric, but do you have well-executed asset management practices? When a system is rebuilt or replaced, are the old computer accounts explicitly removed? Tracking the number of active domain-joined systems starts to make more sense. Now you need to define a threshold for what qualifies as active. Allowing for time off work, let's say that systems are expected to be used at least once every two weeks. Of course, you'll want a procedure to handle someone on extended leave. Perhaps just booting the system or performing a wake-on-LAN call will suffice. Up until now we've been focused on user systems, but don't forget that you need to count your servers as well. If you're an SMB/SME you can probably consolidate the numbers but if you're large enough to have separate IT server and desktop teams, it might make more sense to retain separate accounting.

So now we have some metrics that are starting to be useful:

• # of managed systems
• # of active systems
• % of active / managed systems

But wait, do you see the blind spot? What about unmanaged systems? Having 100% active systems is great but if you have unmanaged / unknown devices in your environment, that's bad right? Of course, computers aren't the only things we have on our networks. We can expect to see network devices such as switches, routers, firewalls, wireless access points, security cameras, and even devices from third parties. Let's generalize and group these into a single category of known devices. If you've been following along, you know that the next logical item is the number of unknown devices, which I'll affectionally refer to as rogue devices.

• # of known devices
• # of rogue devices

Let's distill these and consider how each of these metrics directly corresponds to a clear risk factor. Keep in mind that these can be applied to an entire organization or to individual business units.

• % of active vs inactive systems - Minimize inactive to reduce risk
• % of managed vs unmanaged systems - Minimize unmanaged to reduce risk
• % of known vs rogue devices - Minimize rogue to reduce risk

The last part of this initial puzzle is to establish a comfort threshold or risk appetite for these. I like 5% as a threshold because even in larger Caribbean environments, the list of offenders is manageable. For example, in a 1,000 device environment, tracking down 50 rogue systems is quite achievable in a short period of time. In specialized environments, such as the industrial SCADA/OT/ICS part of a power plant, that risk appetite is going to be much lower, even nil.

TIP: For larger organizations, regularly sharing and comparing the metrics of different business units can help encourage cooperation and support!

Now how and where do we get this data? That's the proverbial million dollar question which we'll discuss in Part 2!.

_{Image Source: Adobe Firefly Generative AI}

Security starts with visibility. Great, I see some trending data but is that good or bad?

You can't manage what you can't measure. Is what we are doing effective? Is what we're doing even useful?

We've all heard these nuggets of wisdom before. And yet with the ever increasing pace of change, complexity, and demands of daily life, it's easy to get stuck in the weeds and neglect metrics and reporting.

Without good metrics, how do we know if we're doing a good job? Without good metrics, how do we justify our time and investment in a product or service? How can we demonstrate that we need more resources such as budget or staff? Worst of all, without meaningful metrics, how do our businesses understand and recognize the value cybersecurity?

So what metrics should we report? The number of blocked network threats is always good eye candy, and so is the number of rejected emails. Do any of these matter to the business? Maybe, if the blocked network traffic negatively impacted a business function. The same goes for blocking emails. These might be more useful to performance management than cybersecurity; so what to do?

Follow our #MetricsMonday series, where we explore cybersecurity metrics with the aim to develop a set of meaningful metrics that directly map to cybersecurity and most importantly, to business outcomes.

So welcome aboard, we're glad you're here.

_{Image Source: Adobe Firefly Generative AI}