Why IT asset management is critical for CDM
Connecting state and local government leaders
IT asset management is much more than a technology or a software solution; it is a strategy that aligns an agency’s internal asset management processes with the Continuous Diagnostics and Mitigation program’s security objectives.
The federal government’s Continuous Diagnostics and Mitigation program is a risk-based, cost-effective approach to cybersecurity. CDM provides management and operational security strategies as well as physical security controls for a multilayer defense strategy for data protection and data loss prevention. Products that support CDM requirements are made available through a pre-negotiated contract, making it easy for agencies to acquire the technology they need to support their CDM objectives.
When agencies master CDM requirements, their IT administrators can see the state of their networks at any given time through agency-level dashboards, helping them identify risks or threats on the network so they can discover and mitigate issues before they become catastrophic.
To ensure success in the CDM program, federal agencies must account for every IT asset that accesses their networks. Undetected IT assets will compromise the accuracy of agency-level dashboards designed to alert administrators about abnormal behavior, increasing risk to sensitive data housed on agency servers.
A solid IT asset management strategy ensures that every asset is properly counted. It gives agencies an accurate view of their network assets so cybersecurity administrators have the information required to make informed decisions when implementing additional CDM capabilities.
However, tracking and managing IT assets continues to be a challenge for some agencies. Too often, manual, time-consuming and inefficient processes and spreadsheets are used to collect and normalize IT asset data. Agencies using such methods should re-evaluate their asset management objectives and processes.
IT asset management is much more than a technology or a software solution; it is a strategy that impacts the entire agency. It requires the agency’s internal asset management processes to be aligned with security objectives. This requires internal acquisition and procurement processes to be clearly defined, enforced and automated, thus ensuring processes used to collect and normalize IT asset data are not compromised by human error.
Asset management solutions typically integrate with network discovery tools that regularly scan the network to identify assets when they join the network. Discovery tools can also spot and alert administrators to assets that have been removed from the network without authorization. Efficient asset management practices ensure that IT assets are tracked when they are physically moved to a new location, when they are reassigned to another employee or project or when they are decommissioned and disposed.
When integrated with other network solutions, asset management dashboards can give administrators IT asset intelligence. For example, IT asset management databases integrated into network discovery tools capture physical information about each IT asset, such as the IP address and software installed on the asset.
However, when integrated with procurement processes and databases, IT asset dashboards can be populated with much more information that is relevant to CDM objectives, such as the purpose or mission of the asset, the services that are to be provided by the asset and the period of time the asset is expected to be authorized.
IT asset intelligence gives administrators a comprehensive view of each asset’s relationship to services, contracts, departments, cost centers, vendors, warranties, utilization, environment, security posture, compliance, availability, location and role. This information is vital for determining how additional CDM capabilities will be applied to the asset.
CDM agency-level dashboard capabilities give agencies visibility into their networks so administrators can prioritize and address potential issues to mitigate risk; however, agency dashboards will not be helpful if they are not accurate. If an IT asset management database is not accurate or up-to-date, sensitive data could be exposed by unknown assets or those with outdated security controls.
When IT asset management best practices are implemented, asset management software will be effective, and IT asset management databases will be accurate. To ensure success with CDM objectives, agencies must implement and follow IT asset management processes and select a comprehensive IT asset management solution that can be aligned to the agency’s CDM objectives.