Latest / CYBR.Signal / Asset Management and Vulnerability Management: Pair Them or Not?

Transcript

Asset Management and Vulnerability Management: Pair Them or Not? · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: Wanted to talk about the latest CISA directive that has come out about vulnerability management and asset management specifically.
• 0:15
  SPEAKER_00: They're tying these two together, and it's kind of the problem I have with this directive.
• 0:19
  SPEAKER_00: So obviously, this affects federal agencies only.
• 0:22
  SPEAKER_00: However, a lot of people take these directives as best practices and use them in their practice if they're in the private sphere in a commercial industry or an organization that is not a government agency.
• 0:35
  SPEAKER_00: And it's why I don't like this directive fully.
• 0:38
  SPEAKER_00: I do think it's a good thing in general that they're focusing on the vulnerability and asset management stuff.
• 0:45
  SPEAKER_00: But if you hadn't have you haven't read it, basically that's what it comes down to is they're saying you have to have really good asset management in order for you to have good vulnerability management.
• 0:56
  SPEAKER_00: My problem with this is the tying together of asset management and vulnerability management as this as if that's the only thing that asset management is good for.
• 1:08
  SPEAKER_00: I think asset management should be its own directive within CISA or any kind of best practice as it relates to cybersecurity because it's not just vulnerability management where it's good for.
• 1:22
  SPEAKER_00: It is good for if you if you look up some of the articles of why asset management is good in cybersecurity, it's so you can proactively find threats.
• 1:32
  SPEAKER_00: Is vulnerability management proactively finding threats, finding problems in your network?
• 1:36
  SPEAKER_00: Absolutely.
• 1:37
  SPEAKER_00: It's not the only thing you do to proactively find a threat.
• 1:41
  SPEAKER_00: Vulnerabilities are one thing to proactively find a threat.
• 1:45
  SPEAKER_00: You can use asset management to find out where there are gaps in your environment or whether there's a where there's a flow through your environment where data can get in and out.
• 1:56
  SPEAKER_00: That's a good asset management thing where you have you where you know all your assets are so you can start mapping out your flow.
• 2:04
  SPEAKER_00: Asset management is good to proactively find threats via putting some kind of agent on the endpoint where you're blocking threats like EDR, antivirus, that kind of thing.
• 2:15
  SPEAKER_00: You don't know where those things are, you can't put an agent on them to protect them.
• 2:21
  SPEAKER_00: Asset management is good to proactively find threats by being able to segment your network out where only, kind of to my point earlier, only certain things can be within that segment.
• 2:32
  SPEAKER_00: Proactively finding, now that we're doing a lot of cloud stuff, been talking about digital transformation a lot.
• 2:38
  SPEAKER_00: Proactively finding in your cloud where your assets are, because it's those that propagation happens so fast in the cloud that if you can't keep up with it with a good asset management strategy, then you're absolutely going to lose control.
• 2:54
  SPEAKER_00: All of those are ways of proactively finding threats that aren't just tied to vulnerability management.
• 3:00
  SPEAKER_00: And my problem with this directive, and I talked about this in an article that I'll link in here as well, is that if you're only if you're tying asset management and vulnerability management together, like this directive is, what you do is take away the importance of asset management being its own discipline.
• 3:23
  SPEAKER_00: And I absolutely think it has to be its own discipline set apart its own thing.
• 3:29
  SPEAKER_00: Vulnerability management is not part of asset management.
• 3:34
  SPEAKER_00: Vulnerability management depends on asset management, but that's not the only thing that depends on asset management.
• 3:40
  SPEAKER_00: So when you tie them together, people start doing the same old thing, they're not thinking about other tools.
• 3:45
  SPEAKER_00: So, what do they do?
• 3:46
  SPEAKER_00: They go do the same old thing that they used to, they put in a vulnerability management tool, they use that to scan the network, and they depend on that to be the source of truth from a cybersecurity perspective for asset management, and it's not the source of truth.
• 4:03
  SPEAKER_00: There are tools now, and I've talked about this in past cyber Sundays, that I was really excited about coming out of Black Hat and RSA, where there's a focus on fundamentals now in cybersecurity, and there's actually technology to help you do those fundamentals better.
• 4:20
  SPEAKER_00: One of those things being asset management is absolutely a fundamental for cybersecurity programs to do asset management, and it needs to be its own discipline.
• 4:32
  SPEAKER_00: Anyway, again, not saying this directive is bad completely.
• 4:38
  SPEAKER_00: I mean, the federal agencies absolutely need to get asset management done and they need vulnerability management to get done.
• 4:45
  SPEAKER_00: Every commercial company, private entity, whatever needs to get that done.
• 4:49
  SPEAKER_00: But if you tie vulnerability management and asset management together that tightly, it makes people focus on them as being a single discipline, and they absolutely are not.
• 4:59
  SPEAKER_00: You need to split those up.
• 5:00
  SPEAKER_00: So, anyway, that's my take on it.
• 5:02
  SPEAKER_00: Let me know what you think.
• 5:04
  SPEAKER_00: Talk to you next time.