Asset Management and Inventory module on the Security Vision platform: even more possibilities

Danila Lutsiv, Ruslan Rakhmetov, Security Vision

The foundation of any process of building an effective information security management structure in an organisation is rightly considered to be the asset management process. In this case, we are not even talking about regulatory requirements, industry standards and best practices. It is more prosaic: it is impossible to effectively manage the security of what we do not know about.

If we extend this thought to Security Operation, it becomes clear that up-to-date, reliable information about assets, both in terms of business processes (criticality, downtime, etc.) and technical characteristics (update list, users, open ports) is no less important for IS than a mature SIEM. The latter is responsible for analysing events, while the inventory system is responsible for analysing system states and their security.

Figure 1. Asset card

As in all our other products, in the ‘Asset Management and Inventory’ product of the Security Vision platform we followed an object-oriented approach. This means that all entities in the system, whether they are information systems, technical means, users, software, etc., are equal elements. Each has its own set of views, workflows or atomic actions. Each has its own set of properties and relationships with other elements of the system. The Asset Management product already contains everything necessary to build an efficient process, however, if necessary, the user can add or modify existing views, processes and property sets. If the existing object variants are not enough, the user can also create their own types. Thanks to the view builder, creating a unique type, be it Certificate, ATM, UPS or Data Backup, now takes no more than a few minutes, right in the GUI of the platform and without the use of layout and HTML. Simply create and move tabs and blocks, and compose the data you need on them.

Fig. 2. Object Builder

When the required list of object types is ready, you can proceed directly to data retrieval. Many of our customers' Information Security departments are responsible for ensuring the required level of security for tens and sometimes hundreds of thousands of devices. Even the issue of downloading such a large number of objects from a source like vulnerability scanners becomes an impossible task for many products.

The Security Vision 5 platform features a unique mechanism for working with sources that:

• Allows processing reports of any format (XML, JSON, CSV, XLS\XLSX) with virtually no volume limitation (tested on various types of data, including vulnerability scanner reports of several gigabytes in size). The retrieval algorithm is designed in such a way that it is no longer necessary to fully load the file structure into RAM to process the data.
  
• Already contains pre-installed connectors to major sources such as Active Directory, Kaspersky Security Centre, Naumen and dozens of other systems. Also supports REST API, SQL, MS RPC and other protocols.
  
• It allows you to configure grouping rules for each of the sources in such a way as to avoid duplicated information and aggregate all available data in a single asset card, updating it with only current relevant information.
  

All integrations are implemented in the Connector Builder, the work of which is absolutely transparent for the end user. Right in the system interface, engineers have access to the functionality of checking results, modifying queries to the source and a huge library of predefined transformations to normalise and bring the resulting data to a single format.

Figure 3. Connector Builder

Most integrations with modern IT and IS solution APIs involve a multi-step sequence of steps consisting of authentications, query generation and subsequent execution of a cycle of commands based on the results obtained earlier. All of this is now also accessible from the interface, without the need for third-party scripts and interpreters. For a group of commands created for a single source, it is now possible to create a single command to start and end a session. This makes it easier to develop new scripts, as well as use third-party credential services such as PAM Credential Vaults.

Figure 4. Connector Builder (sequential steps)

One of the main challenges of any consolidated system for processing IT infrastructure information based on data from different sources is, of course, duplication. How to structure the work with data in such a way that on the one hand to avoid duplicated entities and on the other hand to update the asset with only those data from the source that are most relevant? The grouping rules implemented in the Security Vision platform allow the user to both use pre-defined grouping mechanisms and customise their own based on the fields or combinations of fields received. For each source, for each of the object fields it is possible to configure custom rules for updating/adding information.

Fig. 5. Grouping rules

However, passive collection of information is not always enough. Security Vision has its own asset inventory mechanism, which is able to provide analysts with complete information about the nodes available in the infrastructure even in the absence of accounting data, just on the basis of service responses and other service headers. The user can create custom classification rules using discovered device names, subnets, service responses, or any other information obtained during system scans.

Figure 6,7. Identification of an unrecognised object

The distributed connector services mechanism allows identification of isolated network segments, without the need for direct network access from the platform to the end devices. In case of overlapping addressing or other collisions related to distributed infrastructure, the Connector can add additional values such as ‘Branch Name’ or ‘Equipment Location’ to the data sent to the server.

Figure 8. Connector services

We pay special attention to the security of the authentication mechanisms and the safety of the credentials used in inventory. All passwords and keys used are stored in the platform in encrypted form, but the system allows us to adhere to the concept of zero trust, minimising the risks even in case of its own compromise. The Connector Services mechanism described earlier allows the use of gMSA password distribution and rotation mechanisms built into the Windows infrastructure. Using Group Policy and Just-Enough-Administration tools, IT administrators can granularly grant execution rights to only the necessary set of commands and modules that the platform needs to perform inventory, without giving the account other redundant administrative privileges. All of these authentication and permission sharing mechanisms in an MS Windows infrastructure are easiest to implement when inventorying equipment using the WSMAN (PS-Remoting) protocol. The platform also supports inventory using previous generation protocols (MS RPC/WMI), but we do not recommend using them.

Figure 9. PowerShell and Kerberos settings

In case of successful authentication on the device and/or obtaining information about it from external sources, the system generates a single card asset with exhaustive information about all technical parameters of the system: Specifications, Users and their privileges, Software, Updates, Services, Network interfaces and many other parameters. Based on the configured rules or manually, users can set additional parameters such as System Owner, Technical Administrator, Criticality, Confidentiality/Integrity/Accessibility parameters, links to associated Information Systems, Projects and other business parameters.

Figure 10-14. Technical Asset Information

Separately worth noting is the presentation of information obtained from defence assets. The platform allows the analyst to get in a single window the data collected both directly from the device inventory and from the management servers of the protection equipment. If the platform is configured for two-way interaction and the user has the appropriate rights, the tools for executing various scenarios using the connected protection devices become available in the card.

Fig 15,16. Information about protection tools and response commands

Running enrichment, escalation and response scenarios is now available not only from the object card, but also from the table view. Commands to update asset information, create an incident or perform an active response are now also implemented in a generic view, which speeds up the work considerably.

Figure 17: Commands from the table view

The tabular view of objects also has a number of useful functions for searching, analysing and editing. The interface includes both a full-text search for all fields contained in the objects and a customisable filter that allows you to set different search conditions. For regularly used filters, it is possible to save them in the Asset Management and Inventory view as quick links. In this way they can be shared with colleagues.

Figure 18,19. Quick Search and Filter

To edit multiple objects, the platform now features Mass Operations, which allow both to simply delete or fill in missing data for all selected or filtered assets, and to perform a selected set of workflow (playbook) initiations, thus, for example, updating inventory data or performing a forced anti-virus scan.

Figure 20,21. Bulk operations

In the updated Asset Management and Inventory product of the Security Vision platform, User and Software inventories have also become available. The inbuilt linking mechanism provides insight into which devices a particular software is currently installed on or where a specified user last authenticated. The cards have all the information needed for analysis, from statuses and descriptions to the necessary approval process and user parameters required for security audits.

Figure 22,23. Users and software

Categorising and assigning asset groups and other classifications is often a manual, monotonous operation that causes data to quickly become irrelevant. For automatic assignment of the required parameters, the system implements a mechanism of search directories. The required category, responsible person or group of assets are assigned when the data contained in the directories match. It is possible to use both strict matches and regular expressions. The search can be based on installed software, asset name pattern, subnetwork or service banners. It is possible, based on the workflow builder, to use extensions to this functionality that allow you to assign the desired category based on detected files and folders, branches and registry keys, sensitive information (e.g. PAN) or installed operating system components detected during a bulk search.

Figure 24. Software categorisation search directory

The data in the system may come from many different sources. Employees from different departments may be involved in populating the information, so data conflicts are likely to be unavoidable. To enable users to understand exactly where the information about an object came from, as well as by whom and at what moment this or that value was set, the system implements the History mechanism. All changes related to the object, time and initiator are available for viewing and searching for the values of interest.

Fig. 25: History of changes

Objects in the Security Vision platform are far from static and can be processed in one or several workflows (playbooks) at once, calling information retrieval connectors, filling properties or creating new child objects. In order to understand the current state of this workflow and the path it has already travelled, the user also has access to the Workflow State and Transition History. It can be called directly from the object card.

Figure 26: Workflow History

Table views are often insufficient for efficient work with asset data and their interrelationships. We have provided the possibility of hierarchical display of information in the form of Trees, as well as Relationship Graphs. These representations can be displayed in separate views or reflected within asset cards, as shown in the figure. Such graphs can serve to show the network connectivity of technical nodes or be an investigative tool. The graphs and Trees have the ability to add interactive commands to download additional information directly from the widget interface, or to perform immediate response actions. In the figures you can see the Summary Table of administrative privileges of users on specific nodes and the Network Map Graph within the data centre site.

Figures 27,28. Trees and Link Graphs

The library of widgets, on the basis of which Dashboards and Reports are formed later, is not limited to those described above. The system has a library of inbuilt analytics, containing managerial, operational and technical Dashboards, giving the opportunity to form analytics on the current state of various parameters of systems. For creation of own views the user can use the no-code constructor, which does not require knowledge of SQL or GraphQL. Formation of widgets in the constructor is more similar to summary tables and charts in Excel.

Figure 29-31. Dashboard library and widget editor

Geographical representation of objects and their positioning on the office floor plans is also available in the widget editor. The displayed objects are automatically positioned on the map according to the filled in coordinates. They can change icons and/or add animation to identify the inappropriate state of an asset, and have interactive commands and detailed descriptions available in the context menu.

Figure 32,33. Building map and geo-map

The report editor allows you to create templates of the required format and graphic design directly in the platform interface. Reports can be generated automatically according to the specified schedule or created manually. Creation of both Microsoft Word documents and Excel spreadsheets is available.

Fig. 34,35. Reports

The use of the ‘Asset Management and Inventory’ product allows enriching other software modules of the platform. When activating the ‘Vulnerability Management’ module, related assets become available in the vulnerability card, and related vulnerabilities become available in the technical asset cards. When working with the ‘Incidents’ module, it becomes possible to take into account the characteristics of the attacked node, its criticality and other business parameters when making decisions about handling a specific incident.

Figure 36,37. Linked Vulnerabilities and Incidents

The platform provides granular provisioning of access both at the view and object level and at the level of the interface itself, creating for a user role a unique showcase cleansed of unnecessary menus and objects. These kinds of showcases can be issued to users in related departments, such as IT administrators, auditors, or risk analysts.

Figure 38,39. Creating roles and user showcases

The ‘Asset Management and Inventory’ system of the Security Vision 5 platform is designed to automate and robotise virtually any technical and logical infrastructure inventory management process. Its functionality includes tools for agentless collection of system information with or without the use of endpoint accounts. A variety of connectors to different systems and a duplication mechanism allow to efficiently manage and consolidate the data received into a single, maximally up-to-date representation of the object and its states. The product contains all the various processes of identification, enrichment and management of information assets, their technical state, categorisation and life cycle stages. Inbuilt analytics helps to identify bottlenecks in existing IT and IS processes, as well as greatly simplify interaction with auditors and regulators.

The product can be used to easily implement asset lifecycle management methodologies, from budgeting to write-off and disposal; to assess the impact of systems on business processes (Business Impact Analysis); and to plan Business Continuity/Disaster Recovery exercises.

Data from inventory and categorisation enrich related modules of the platform such as:

Vulnerability Management Module

Incident Management Module

CII Categorisation Module

Risk Management Module

Audit and Compliance Assessment Management Module

On 4 April 2023, Security Vision released a new module release. New features have been added to the product to handle asset software (AS) and updates.

The following new features have been made available to users:

- Maintaining a ‘whitelist’ of software in the module. Each software added to the module is checked for inclusion in the ‘white’ list: the ‘Software in the white list’ attribute is set in the card. The user can configure the rules by which the software will be included into the white list.

- In the software card for users the possibility to manually add or remove software from the lists of allowed software has been added.

- For operational control over the installed software, new sections with key attributes have been added: General list, Not allowed software on hosts, Allowed software.

- The module is equipped with the ability to store software updates. For each update there are full and short cards for viewing and editing information, you can attach the update file to the card or specify a link to the repository from which the update file will be uploaded. Also in the product interface you can specify software update scripts for different types of operating systems.

- Added links between the software card and software updates of different versions and platforms.

- Added software update process on assets: user selects assets and software update files to be run on assets. It is also possible to run the update simultaneously on all assets linked to the software. This action can be configured to be performed both manually and automatically according to specified rules.

- Added the process of software removal from assets: the user selects the assets on which the corresponding software should be removed. It is also possible to run a one-time uninstallation on all assets bound to the software. This action can be configured to be performed both manually and automatically according to the specified rules.

Video about the module: https://youtu.be/IRO-p8q0XBo

Video about practical application of the module: https://youtu.be/_zvVaiI0auA