A very sketchy view of asset management problem from the InfoSec perspective

Here are slides from my UISGCON14 talk in Kyiv -- it was on "fast track" so I had just 20 minutes, so it is not as detailed as I wish it to be.

However, the central topic is obvious: if you do asset management for infosec purposes, you are mostly on your own. ITSM-originated asset management focuses on service availability and expenses (and downtime costs); so-called Software Asset Management is a fancy word for keeping count of your licenses, and CMDBs simply cannot work as intended at scale.

Transcript

1. 2 0 1 8 HARD TO FIND, EASY TO LOSE (Asset management from the Infosec perspective) – UISGCON14 KYIV 2018 –
2. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 2 # whoami You don’t exist, go away! “BOUTIQUE” INFORMATION SECURITY CONSULTING Finding gaps Making things work Saying the obvious (and unpopular) things aloud Located in Varna, Bulgaria
3. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 3 Asset definition AN “ASSET” IS SOMETHING THAT HAS INTRINSIC VALUE TO A PERSON OR AN ENTERPRISE. This definition is unofficial. There is no “official” definition of an asset even in ITIL, which makes things a bit vague. Yet from the risk management perspective, an asset is a good “elementary particle” to deal with. Be prepared: when you talk to people from the Finances, they have their own understanding what an asset is (from accounting perspective). And you do not have any suitable synonym to prevent the confusion. Measuring the value of an asset is hard, and this information rarely can be obtained directly.
4. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 4 Why asset management is so important? HELPS YOU TO KNOW MULTIPLE THINGS AT ONCE BEFORE LOOKING CLOSER Attack surface (inventory) Vulnerability Value and risk
5. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 5 In reality things are massively misaligned DATA SOURCES ARE INCONSISTENT AND SYSTEMS ARE MANAGED BY DIFFERENT TEAMS Attack surface from SAMdb/CMDB Risk knowledge is incomplete and unreliable Vulnerability and attack surface from inventory scan
6. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 6 Do you have software asset management?
7. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 7 Inconsistent goals SAM (Software asset management) is focused on license management; ITAM (IT asset management) is focused on service availability; RM (Risk management) in typical organization is part of dreadful “GRC” triad, and mostly impractical; Configuration management has limited scope(s) and lacks completeness metrics. Which mostly leaves us with our own Infosec-centric software inventory made on ad hoc basis. From now on we will focus on inventory and discovery process.
8. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 8 Consistent goals Uniform, machine readable data; Complete without blind spots; Up to date and accurate. Unix vs Windows: embracing chaos at early stage worked as huge benefit for Windows environment (“worse is better”). From now on we will focus on Unix/Linux problems.
9. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 9 Enumerating software CPE (Common Platform Enumration) by NIST; ISO19770 SWID tags; Vendor package names. (SOMEWHAT LOWER LEVEL THAN ASSET)
10. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 0 Uniform, machine readable data Enumeration standards are ignored by software vendors; CPE dictionary is incomplete and sometimes inconsistent in spelling; The only reliable data format is package list in Linux distribution’s vendor naming convention; Attempts have been made to automate fuzzy matching.
11. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 1 Complete without blind spots “Secondary” packages: npm, CPAN, PIP, brew, etc.; Third-party software installers bypassing package managers; Dependent libraries pre-packaged with third-party installers; Custom built software; Containers, VMs and obscure runtime environments; IoT components.
12. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 2 Up to date and accurate Mobile and movable devices; Things that get switched on and off; On-demand containers and VMs; Firewalled environments; Shadow cloud services; IoT components; After a few M&A’s any company loses track of its software assets.
13. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 3 “Best practices”? ITIL is, mostly, dead or reduced to cargo cult, especially in CMDB/ITAM part. NIST SP1800-5 “IT Asset Management Practice Guide” is a remarkable compilation of obsolete software manuals spiced with utter futility sauce.
14. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 4 Conclusion Automate everything. Things that are not automated will never be properly accounted or documented. Discovery is band aid. A necessary one, because at certain point there will be things that are not managed via automation. You have more blind spots than you think. Watch carefully. Moving from SAM to ITAM and RM requires one more parameter: monetary value (multiple values for different failure modes). You are really lucky if you can find it easily.
15. H A R D T O F I N D , E A S Y T O LO S E — U I S G C O N 1 4 1 5 Questions? arkenoi@gmail.com facebook.com/glancltd