ISR10: Insufficient Asset Management and Documentation
How ISR10: Insufficient Asset Management and Documentation works
Insufficient asset management is the gap between what is actually connected to an estate and what any inventory records. It lives in the CMDB, the DHCP scopes and internal DNS zones, the hypervisor and switch consoles, the EDR and patch dashboards and the vulnerability scanner’s target list, each of which holds a partial and differently stale view of the same network. The document that is meant to reconcile them is usually a spreadsheet owned by a team that has since reorganised, alongside process and ownership notes that stopped matching reality several projects ago.
It survives because the gap is invisible from inside the record. An unlisted host still boots, still routes and still serves; the only symptom is a number that is quietly too small. Every other risk in this list is reported as a fraction whose denominator is the asset inventory - hosts patched, hosts carrying an agent, hosts scanned, hosts hardened - so anything missing from the inventory is missing from the numerator and the denominator at once and the ratio comes out clean. A host nobody lists is fully compliant by arithmetic. After initial access that delta is where an attacker lives: unpatched, unmonitored, unscanned and with nobody assigned to notice, and during incident response it is the reason scoping takes days. The three chapters below take one surface each. Shadow IT And Unmanaged Hosts reconciles active discovery against the CMDB and reports the delta. Forgotten And Undecommissioned Systems traces hosts that outlived their owner and the evidence needed to retire them. Incomplete Vulnerability Scan Coverage measures what a clean scan report actually looked at.
Keywords: asset inventory, cmdb reconciliation, shadow it, decommissioning process, scan coverage, unmanaged hosts
Examples/Proof
- Discovery to CMDB delta
- Sweep every routed internal prefix, pull DHCP leases and switch MAC tables, then left-join the result against the CMDB export. Each responding address with no record is unmanaged surface and a finding.
- Denominator check across consoles
- Compare the host count claimed by the EDR, patch and vulnerability scanner consoles against each other and against the inventory. Three different totals for one estate means at least two reports are wrong.
- Orphaned name records
- Resolve every A and CNAME record in the internal zones and probe each answer. Records answering from hosts with no owner, and records answering from nothing at all, are both findings.
- Last-contact sort
- Sort the inventory by last successful patch, agent check-in and interactive logon. The tail - hosts live on the wire but silent in every management plane - is the forgotten estate.
Detection and Monitoring
- First-seen device alerting
- Alert on a DHCP lease or a switch port learning a MAC address absent from the inventory; a first-seen device on a user VLAN should raise a ticket, not a silent grant.
- Console population drift
- Track the daily delta between the inventory host count and the EDR, patch and scanner host counts; a widening gap measures inventory decay long before an audit does.
- Reachable but unscanned counter
- Count addresses that answered a discovery sweep and appear in no completed scan job; any non-zero value is unmeasured risk being reported as clean.
How to fix and prevent ISR10: Insufficient Asset Management and Documentation
- Name one authoritative inventory and an owner for every record
- One system of record, with a named technical owner, business service and criticality per asset. A spreadsheet with no owner is not an inventory.
- Feed it from automated discovery rather than from a form
- Reconcile ARP, DHCP, DNS, switch MAC tables, hypervisor and cloud APIs, directory objects and EDR enrolment into the record daily. Partial control: discovery only sees what is powered on and reachable while it runs, so keep several sources.
- Reconcile every control console against the inventory on a schedule
- Publish patch, agent and scan coverage as a percentage of the inventory with the missing hosts named, so a gap produces a ticket instead of a rounded figure.
- Make decommissioning a process that produces evidence
- Isolation, soak period, media wipe, DNS and certificate removal, backup and monitoring cleanup, licence release and record closure, each recorded. An asset is retired when the evidence exists and the next sweep agrees.
- Document processes, dependencies and responsibilities beside the asset record
- Incident scoping and patch prioritisation both fail on an inventory that lists addresses but not what runs on them or who answers for them.
Prevention Checklist
- One system of record is designated authoritative and every asset in it carries a named technical owner and a criticality rating
- Automated discovery runs at least daily and its delta against the inventory is triaged by a named queue, not archived
- EDR, patch and vulnerability scan coverage are each reported as a percentage of the authoritative inventory
- Every decommissioning produces retained evidence of media wipe, DNS and certificate removal and inventory closure
In this section
- Shadow IT And Unmanaged HostsShadow IT is any device or service on the internal network that no inventory lists.
- Forgotten And Undecommissioned SystemsForgotten systems are hosts that outlived their purpose and their owner but were never switched off.
- Incomplete Vulnerability Scan CoverageIncomplete scan coverage is a clean vulnerability report produced by a scan that only ever looked at part of the estate.
Last updated
