Endpoint Management, Asset Inventory and Posture Assessment

What it is

Endpoint management controls and tracks devices, and posture assessment checks whether a device is healthy enough to connect.

You cannot protect devices that you do not know about. Management and inventory systems keep a list of devices and push settings to them. Posture assessment then checks the device against a policy before it receives network access.

How it works

Start with what you manage, then check whether it meets policy.

Mobile device management

Mobile device management (MDM) controls phones, tablets and often laptops from a central console. The device enrols, and the platform installs a management profile on it. The administrator can then configure and monitor it.

Typical MDM capabilities include:

• Configuration: Wi-Fi, VPN and email settings, pushed to the device.
• Application management: install, update or remove apps.
• Security policy: require a passcode, disk encryption and a minimum operating system version.
• Compliance reporting: show which devices meet policy.
• Remote actions: lock a device, or wipe it when it is lost or stolen.

Related terms are mobile application management (MAM), which controls only the managed apps, and unified endpoint management (UEM), which covers phones, laptops and other devices in one tool.

Corporate and personal devices

On a personal device you usually separate work data from personal data. If the user leaves, you remove the work data and leave the rest.

Asset inventory

An asset inventory is an accurate list of what you have. It records the device type, owner, operating system, installed software, patch level and location. Sources include the MDM, the endpoint agent, network discovery and the directory.

Inventory supports security in practical ways. It shows unmanaged devices, finds software that needs patching, and identifies which assets are affected by a new vulnerability. Without it, you do not know the size of the problem.

What posture assessment is

Posture assessment is a check of the device state against policy, normally at the time of connection. Common checks cover:

• An antimalware product is installed, running and up to date.
• The host firewall is enabled.
• The operating system has the required patches.
• Disk encryption is enabled.
• A prohibited application is absent, or a required one is present.

Posture with Cisco ISE

Cisco Identity Services Engine (ISE) can enforce posture. A software agent on the endpoint, such as the posture capability of Cisco Secure Client, performs the checks and reports the result to ISE. A client without the agent can be redirected to download it.

The process works in stages. A new device is first given limited access. The agent checks it, and ISE sets its posture status.

A noncompliant device can be sent to a remediation page, which tells the user what to fix. After the fix, the device is checked again and moved to compliant. ISE can also use information from an MDM, such as whether a phone is registered, encrypted and has a passcode, as part of its decision.

Other posture sources

Other tools report device health too. Cisco Duo can check the health of a device before it allows a login, and Cisco Secure Firewall Posture, previously called HostScan, checks a device that connects over VPN.

Limits

Posture is a snapshot at one moment, so a device can become unhealthy later. Some systems recheck at intervals. Devices that cannot run an agent, such as printers, need other methods such as profiling.