Ruslan Rakhmetov, Security Vision
Asset management is the foundation upon which all cybersecurity processes are built: vulnerability remediation, configuration control, incident response, and business continuity all depend on the quality and completeness of asset data. However, implementing asset management isn't as simple as it seems, and even large infrastructures can contain gray areas, shadow assets, and unaccounted-for systems. In this article, we'll discuss asset inventory and management and explain why it's impossible to protect what you don't know.
Let's start with definitions. Generally speaking, an asset is a resource, whether tangible or intangible, that a company controls and uses to generate economic benefit. In the context of information security, an asset is an entity that has value to the organization, is used to achieve the organization's goals, and is subject to protection and attack aimed at compromising security properties.
Asset Management is a systematic process that involves the cost-effective creation, use, maintenance, renewal, and decommissioning of assets.
Assets are divided into tangible (e.g. hardware, devices, equipment, premises, etc.) and intangible (e.g. software, information security tools, information, data, trademark, license, patent, intellectual property, reputation, etc.).
Assets can be of different types (each of which can have its own set of attributes):
· information system;
· technical means (server, automated workstation, network device, printer, telephone, data storage system, etc.);
· software (OS, software, database, information security system, application);
· information;
· user (account);
· business objects (processes, premises, suppliers, products/services from the supplier, from the cloud, etc.).
The importance of asset management for information security processes is emphasized in various Russian regulatory legal acts:
1) In the Methodological document "Methodology for Assessing Information Security Threats" (approved by the FSTEC of Russia on 05.02.2021), in paragraph 2.2, subparagraph "b)" it is stated that one of the main tasks solved during the assessment of information security threats is the inventory of systems and networks and the identification of possible targets of information security threats.
2) Order No. 117 of the Federal Service for Technical and Export Control of Russia dated April 11, 2025, "On Approval of the Requirements for the Protection of Information Contained in State Information Systems, Other Information Systems of State Agencies, State Unitary Enterprises, and State Institutions" states that control over information system configurations is carried out based on an analysis of the results of IT asset accounting and/or IT asset inventory systems. This Order provides references to RF Government Resolution No. 900 dated July 1, 2024, "On the Procedure for Accounting of IT Assets Used for the Implementation of Activities on the Digital Transformation of the Public (Municipal) Administration System" and to the "Regulation on the Accounting of IT Assets Used for the Implementation of Activities on the Digital Transformation of the Public (Municipal) Administration System" itself.
3) the Methodological document "Composition and content of measures and measures to protect information contained in information systems" (approved by the FSTEC of Russia on 12.04.2026) contains the measure "IAF.2: Identification of devices".
4) Order of the Federal Service for Technical and Export Control of Russia dated 18.02.2013 No. 21 "On approval of the Composition and content of organizational and technical measures to ensure the security of personal data when processing them in the Information System of Personal Data" contains the following measures:
· IAF.2: Identification and authentication of devices, including fixed, mobile and portable devices;
· ZNI.1: Accounting of machine-readable media containing personal data.
5) the Order of the Federal Service for Technical and Export Control of Russia dated 25.12.2017 No. 239 "On approval of the Requirements for ensuring the security of significant critical information infrastructure facilities of the Russian Federation" contains the measure "AUD.1: Inventory of information resources".
6) Order of the Federal Service for Technical and Export Control of Russia dated March 14, 2014, No. 31, dedicated to the protection of information in automated process control systems, contains the following measures:
· AUD.1: Inventory of information resources;
· ZNI.1: Accounting of machine-readable information carriers.
Various foreign documents also contain regulations describing the requirements for asset management. For example, in ISO 27001:2022 standard is present Control A.5.9 "Inventory of information and other associated assets". Publication NIST SP 800-53 includes the CM-8 "System component inventory" and PM -5 "System inventory", and publication NIST SP 1800-5 "IT Asset Management" is entirely dedicated to asset management. Furthermore, the IT asset and inventory management process can be structured according to various methodologies, such as:
- ITIL (Information Technology Infrastructure Library);
- COBIT Control Objectives for Information and Related Technologies);
- ISO/IEC 19770-1 "Information technology – IT asset management".
A typical life cycle of an IT asset may consist of the following stages:
1. Development of an asset life cycle strategy;
2. Planning the use of IT assets (formation of a standard for the asset and the organization’s requirements for its accounting);
3. Development of architecture and asset usage model;
4. Purchase or independent development, implementation;
5. Operation;
6. Support (repair, maintenance, modernization);
7. Making changes;
8. Withdrawal to reserve;
9. Decommissioning (write-off);
10. Reliable asset destruction, guaranteed removal of confidential information.
To effectively ensure cybersecurity and manage information security processes, it is crucial to see and understand all protected objects and their properties. It is essential to understand the location of assets, their characteristics and users, and what security measures can be implemented on specific assets. For example, if an administrator is selecting a new corporate EDR solution, it is important to know in advance how many endpoints running a particular operating system (Linux, Windows, MacOS) are present in the infrastructure. Furthermore, it is important to understand at any given time which information security tools are running on assets, the state of these security solutions (active or disabled, what policies are applied), and what settings are configured on the assets. When implementing vulnerability and configuration management, it is critical to understand not only the properties of an asset and its software component, but also its importance level – the prioritization of remediation of vulnerabilities or insecure settings depends, among other things, on the criticality of the device. When managing business continuity and recovery, it is also necessary to understand the properties of the asset and its role in the information system and business process, its connections with other assets, and their interdependencies. Threat modeling and cyber risk management also consider the properties and characteristics of assets – their components, interfaces, settings, connections, and criticality level, as well as the history of incidents associated with the asset. Compliance management requires understanding the standards a given asset must meet – for example, if a device is part of a critical information infrastructure (CII) or a component of a personal data system (PDS). When responding to information security incidents, it's essential to understand the properties of the attacked asset: what operating systems, software, and information security tools are installed, who operates the device and who is responsible, what business processes depend on the asset, and whether the device can be isolated, rebooted, or patched. The worst-case scenario for a SOC analyst is to witness a dangerous incident on an asset about which nothing is known, which is why SIEM/SOAR/TIP/UEBA systems require tight integration with asset management systems.
So, the usefulness and importance of understanding infrastructure components is undeniable – the goal is to obtain up-to-date information about assets. There are three main methods for collecting information:
1) Agent method: software agents are installed on devices that collect inventory information about assets and transmit it to the asset management server.
2) Agentless method: the inventory server performs an inventory scan on devices on the network (it goes through the list of IPs/subnets, collects device names from a reverse DNS request), then it can perform an unauthenticated scan (read the device's responses to network requests and determine the services running on them) and an authenticated scan (remote login to the device using valid credentials is performed, then commands are remotely executed on the device to obtain a list of users, OS characteristics, software, hardware and network configurations).
3) Integration method: the asset management system integrates with directory services (Active Directory in Windows environment, ALD PRO, FreeIPA, Samba DC in Linux), with vulnerability scanners, with SIEM systems, with antivirus/EDR, with DLP solutions, with configuration management systems, or receives information about assets from IT systems (ITSM, Help Desk) and from various internal representations (e.g. from CSV files).
After inventorying assets, they are classified (categorized) by importance. For example, a device running a server OS may be considered a higher priority than a user desktop, and devices in the server IP range are more important than objects in user segments. Relationships between assets are then identified, owners, responsible parties, and users are identified, and the asset is monitored for information security status (OS and software versions, information security system status, the presence of alerts and incidents, and asset availability). Many asset management systems support remote device management – for example, using automation scripts and WMI, PowerShell, WinRM, and Linux commands. bash allows you to view a list of sessions, lock an account, get a list of local administrators, view a list of processes and terminate them, view a list of network adapters, and more.
Ultimately, the asset management system card will display the following information about the device:
- business owner (business owner) of the asset;
- risk owner (risk owner) of the asset;
- person responsible for the asset from the IT side (IT custodian);
- person responsible for the asset from the information security side (IT Security custodian);
- asset user;
- the business role/function performed by the asset;
- the technical role/function performed by the asset;
- asset-dependent business process;
- criticality (will be useful for vulnerabilities later!), cost, value of the asset;
- requirements and level of information security (integrity, confidentiality, availability) of information processed by the asset;
- location (address, premises, counter number, etc.);
- configuration (FQDN name, OS version, installed software, VLAN, IP address, MAC address, RAM size, etc.);
- availability indicators and recovery requirements: recovery point objective (RPO), duration of recovery (RTO – Recovery Time Objective), maximum permissible period of interruption of activity (MTPD – Maximum Tolerant Period of Disruption).
At the same time, there are a number of challenges that hinder comprehensive infrastructure coverage by the inventory process. For example, industrial and process network segments are typically isolated from the corporate infrastructure, so the inventory server will not detect devices in the OT segment (various controllers, ICS components, IoT / IIoT devices, etc.). For inventory and asset management, a dedicated server is placed in the OT infrastructure to analyze the network and account for process assets, and the inventory settings will be optimized to minimize impact on equipment. Another challenge is so-called "shadow IT": employees independently deploy and connect various solutions (from virtual machines to portable devices) to the corporate network, install various software without approval, including AI agents, instant messengers, and cloud synchronization systems, and change the settings of corporate devices without permission (for various reasons). As a result, inventory management should be continuous, not episodic – only constant monitoring of the infrastructure will ensure that asset information is always up-to-date and reliable.
In conclusion, it's important to understand the connections between assets to solve information security problems – for example, by creating a diagram like "server - application - information system - business process." To represent such connections, a company's infrastructure resource-service model is used, which describes infrastructure components and the connections between objects, such as: service/service/business process -> information system -> responsible person, administrator, user -> OS, software, information security system -> equipment (server, workstation) -> premises, data center.
To automate inventory and asset management, the Security Vision portfolio includes the Asset Management product (Security Vision AM/CMDB ), which enables automatic asset discovery on the network, categorization, and collection of comprehensive information about them, including from corporate systems. It also builds a resource-service model and provides remote device management capabilities, which is important when responding to cyber incidents and solving IT administration problems. Security Vision VM (Vulnerability Management), Security Vision VS (Vulnerability Scanner) and Security Vision SPC (Security Profile Compliance) also allows for the inventory of information assets using their own mechanisms or through integration with various corporate systems.
The resource-service model of the infrastructure, created in Security Vision AM/CMDB, is the foundation of all information security processes automated on the Security Vision platform. It is from this resource-service model that Security Vision products such as:
· Security Vision SIEM;
· Security Vision SOAR / NG SOAR;
· Security Vision TIP;
· Security Vision UEBA;
· Security Vision BCM;
· Security Vision CM;
· Security Vision RM.
.jpg)
.jpg)
