Asset, Configuration, Mobile, Patch and Vulnerability Management

What it is

Management concepts are the routine processes that keep an organisation's systems known, consistent and up to date.

Five matter here. Asset management knows what you own, configuration management keeps it set up correctly, mobile device management covers phones and tablets, patch management fixes known flaws, and vulnerability management finds and tracks weaknesses.

Together they shrink the attack surface and make incidents easier to investigate, because the team knows what each system is meant to look like.

How it works

Each process has a goal, an input and an output, and each feeds the next.

Asset management

Asset management keeps an up to date inventory of hardware, software, data and users. Each asset has an owner, a location, a purpose and a value or criticality rating.

You cannot protect what you do not know about. During an incident, the inventory tells the team what a compromised host does and how important it is. Shadow IT, which means systems that nobody recorded, is a common gap.

Configuration management

Configuration management defines and maintains the approved settings of systems. It starts with a baseline, which is a known good configuration for each type of system.

Changes go through change control. Someone requests the change, it is reviewed and approved, it is made, and the baseline is updated. Tools compare the current state with the baseline and report drift, which is any difference.

Unauthorised changes can mean either an error or an attacker. A configuration baseline also helps rebuild a system quickly after an incident.

Mobile device management (MDM)

Mobile device management controls phones and tablets that connect to company data. It enrols devices and applies policy from a central console.

Typical controls include:

• Requiring a passcode and device encryption
• Pushing approved apps and settings
• Blocking jailbroken or rooted devices
• Separating company data from personal data
• Remotely locking or wiping a lost device

MDM is especially useful with bring your own device programmes, where staff use personal phones for work.

Patch management

Patch management is the process of finding, testing, deploying and checking software updates. Patches fix known vulnerabilities, and attackers often target flaws that already have a fix.

A typical cycle has these steps.

1. Identify which systems need which updates.
2. Test the patch on a small group.
3. Deploy it, with a schedule and a rollback plan.
4. Verify that it installed and that systems work.

Urgent patches may be fast tracked when a flaw is being actively exploited. Systems that cannot be patched, such as old devices, need other controls such as segmentation.

Vulnerability management

Vulnerability management is the continuing process of finding, ranking and fixing weaknesses. It uses scanners to check systems against a list of known flaws.

The cycle runs as follows.

1. Discover the assets to scan.
2. Scan them for vulnerabilities.
3. Prioritise the findings, often with a severity score such as CVSS and the criticality of the asset.
4. Remediate by patching, changing configuration or adding a control.
5. Verify with a rescan, and report.

Scanning is not the same as a penetration test. A scan lists possible weaknesses, and a penetration test tries to use them.

How they fit together

The asset inventory tells you what to scan. Configuration baselines tell you what is correct. The scan finds flaws, patch management fixes many of them, and MDM extends the same discipline to mobile devices.