Security Boulevard

Authors/Presenters:Yiran Zhang, Qingkai Meng, Chaolei Hu, Fengyuan Ren

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Revisiting Congestion Control for Lossless Ethernet appeared first on Security Boulevard.

How Asset Discovery Tools Work

What Is an Asset Discovery Tool?

Types of IT Assets

The Benefits of Asset Discovery

How Does IT Asset Discovery Work?

Top 5 Use Cases for Asset Discovery

Manage Your Network Assets with FireMon

Frequently Asked Questions

Get a Demo

How Asset Discovery Tools Work

As organizations grow, their IT assets grow exponentially. According to Technavio, the global IT asset management software market size is estimated to grow by $456.14 million between 2024 and 2028, growing at a CAGR of nearly 7.58% during the forecast period.

Effective infrastructure management starts with a thorough inspection of your organization’s environment. To effectively identify and record assets across hardware devices, software applications, network components, and more, IT professionals can leverage asset discovery tools.

With accurate asset inventory management, organizations can strengthen their security posture, optimize and allocate resources, streamline processes, and meet compliance.

What Is an Asset Discovery Tool?

An asset discovery tool is a software solution that automatically identifies, classifies, catalogs, and monitors all assets within an organization’s IT infrastructure. Asset discovery tools can identify known resources as well as uncover redundant, unmanaged, or unauthorized assets and devices.

There are two different types of IT asset discovery tools: active and passive.

The difference between an active vs passive asset discovery tool is that an active one proactively sends requests to assets and collects responses to manage the assets. Passive discovery monitors network traffic without directly interacting with the devices.

Types of IT Assets

An organization’s infrastructure is composed of many different assets. Ten of the most common types of IT assets managed with discovery software include:

Asset Type Definition Example Hardware Physical devices and equipment Laptops, desktops, servers, printers, and routers Software Applications and programs Operating systems, enterprise applications, and productivity software such as Windows, Oracle, or Microsoft Office Network Components that provide communication or connections between devices Routers, firewalls, and wireless access points Cloud Resources or services provided over the internet by third-party providers in the cloud Cloud storage, cloud computing platforms, and SaaS applications such as Salesforce Data Information typically important or sensitive that is stored and processed Databases, intellectual property, financial figures, and customer records like a CRM Endpoint Physical devices that connect to a network Desktops, servers, laptops, and mobile devices Security Systems, software, or tools designed to protect your infrastructure Antivirus software, intrusion detection systems (IDS), and encryption tools Virtual Digital versions of hardware or software Virtual desktops, containers, and virtual machines (VMs) Mobile Portable devices Smartphones, laptops, and tablets Internet of Things (IoT) Internet-connected devices Wearable devices, sensors, smart devices like doorbells and thermostats

These assets are critical components of modern infrastructure, and they can be easily discovered and monitored through asset management. Organizations can also reveal known, unknown, vendor, and rogue assets. After all, you can’t manage what you can’t see.

The Benefits of Asset Discovery

As organizations grow and evolve, assets are constantly being added, removed, or modifiedmaking it difficult to maintain an accurate inventory. The addition of shadow IT, where unauthorized devices and software are used without the knowledge of IT departments, further obscures asset visibility.

With continuous asset discovery, organizations can detect shadow clouds, network infrastructure, and unknown endpoints.

The main benefits of asset discovery include:

• Improved Security: Reduces risk with continuous, accurate detection of assets
• Operational Efficiency: Accelerates business while reducing time and resource needs
• Cost Reduction: Eliminates redundant assets that can be modified or reduced
• Compliance Assurance: Streamlines inventory for accurate compliance reporting
• Enhanced Decision-Making: Helps determine network upgrades, cloud migration, and address business changes quickly

How Does IT Asset Discovery Work?

IT asset discovery works by identifying and cataloging devices in a network, including endpoints, routers, switches, and OT/IoT devices. They can be used in both cloud and on-premises environments.

Through the asset discovery process, organizations can find specific information, including usage patterns, software installs, and configuration details. This data is consolidated into a centralized inventory, providing IT and security teams with an up-to-date, unified view of their asset data. This single source of truth helps manage, track, and secure IT resources effectively.

Top 5 Use Cases for Asset Discovery

IT asset discovery ensures that organizations maintain complete visibility and awareness of their full infrastructure, reducing risks and costs while enhancing overall organizational efficiency. The top 5 use cases for asset discovery include:

1. Asset Inventory

Modern asset discovery tools provide real-time monitoring to maintain accurate asset inventories, including hardware specifications, software versions, and usage metrics. The asset inventory data can be enhanced with additional context such as asset ownership, department associations, lifecycle stages, and more.

2. Change and Configuration Management

Automated asset discovery can also determine when devices join or leave the network, as well as configuration changes. The discovery tools continuously update the asset database with these ongoing changes for strategic planning.

3. Risk and Vulnerability Assessment

Advanced analytics can be applied with asset discovery to identify trends, detect anomalies, and optimize asset management strategies. Real-time discovery can also help quickly address security vulnerabilities, compliance issues, and operational inefficiencies by providing an at-a-glance view of the IT environment.

4. Software License Compliance

By automatically identifying and cataloging all software installed in their IT infrastructure, organizations can easily track how many software licenses are in use vs how many have been purchased, ensuring compliance with licensing agreements. Organizations can also avoid costly fines and legal issues, as well as identify unauthorized or outdated software that might be non-compliant with current licensing terms.

5. Cloud Resource Optimization

Cloud can often be a black box, but with asset management discovery tools organizations gain visibility into their cloud assets, including storage, services, and instances across cloud providers. This visibility enables IT professionals to identify underutilized or idle cloud resources, which can then be redistributed or reevaluated.

Manage Your Network Assets with FireMon

For real-time active, passive, and targeted network and device discovery, organizations can leverage FireMon Asset Manager to detect unknown, rogue, shadow clouds, network infrastructure, and endpoints in the enterprise.

FireMon Asset Manager can protect a wide range of assets, including but not limited to:

1. All Layer 2 and Layer 3 devices in on-premises and cloud environments
2. Physical devices such as servers, workstations, and networking equipment
3. Virtual machines
4. Cloud-based assets across various platforms like AWS and Azure
5. Network asset discovery across infrastructure components and IoT devices

Request a demo today and discover why FireMon is one of the best asset discovery tools for your enterprise.

Frequently Asked Questions Why Is Asset Discovery Important?

According to Forrester and the Global Tech Spend Forecast, software and IT services will account for 69% of global tech spend by 2027. This shows the growing need for asset discovery tools to track and manage organizations’ investments across their network from desktops, servers, laptops, and beyond.

By tracking assets, organizations can reduce spend, minimize waste, better allocate resources, and secure their assets. After all, you can’t secure what you can’t see.

How Does Asset Discovery Help You Understand Your Attack Surface?

Asset discovery provides organizations with a comprehensive view of their assets where they can identify every component in their infrastructure with all access points. Organizations can then identify vulnerabilities, detect rogue and unauthorized devices, better manage their hybrid environments, and respond to cybersecurity incidents faster.

What Are the Differences Between Active and Passive Discovery Tools?

The difference between active and passive discovery methods is how they collect and identify asset information. Active discovery tools actively query the network by scanning the devices and software, whereas passive discovery tools monitor the activity on the network without any probes or queries.

An active discovery tool may impact network performance due to the active scans; however, it can provide more detailed and real-time information.

Active discovery is best when an organization needs full, detailed visibility for compliance checks, vulnerability management, and auditing. Passive discovery is useful for continuous monitoring without any additional traffic on the network.

Get 9x
BETTER Book your demo now Sign Up Now

Get a Demo

Customers

Customer Success Training Hub
User Center

Partners

Partner Directory
Partner Portal
Technology Partners

Company

About
Careers
Contact

The post How Asset Discovery Tools Work appeared first on Security Boulevard.

via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!

Permalink

The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #306 – My Door Is Always Open appeared first on Security Boulevard.

Discover how API security is crucial in meeting DORA compliance by securing data transmission, managing third-party risks, enforcing governance.

The post How API Security Fits into DORA Compliance: Everything You Need to Know appeared first on Security Boulevard.

Defining “normal” and taking the first step in next-gen threat detection Organizations face an increasing array of threats, from sophisticated malware to insider threats. Behavioral baselining helps companies safeguard sensitive data and maintain robust security postures by clearly defining what “regular” looks like. Let’s dive into what behavioral baselining is, and why it’s critical for...

The post Behavioral Baselining and its Critical Role in Cybersecurity appeared first on TrueFort.

The post Behavioral Baselining and its Critical Role in Cybersecurity appeared first on Security Boulevard.

Google over the past week has taken numerous steps to better Chrome users, including taking new steps toward reducing the use of passwords for authentication and hardening its post-quantum encryption.

The post Google Expands Chrome Security and Privacy Capabilities appeared first on Security Boulevard.

Authors/Presenters:Shibo Wang, Shusen Yang, Xiao Kong, Chenglei Wu, Longwei Jiang, Chenren Xu, Cong Zhao, Xuesong Yang, Jianjun Xiao, Xin Liu, Changxi Zheng, Jing Wang, Honghao Liu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Pudica: Toward Near-Zero Queuing Delay in Congestion Control for Cloud Gaming appeared first on Security Boulevard.

Thank You Chicago! Earlier this week we had the pleasure of hosting a regional API Security Summit in Chicago (well, actually in Lombard). These summits bring together the local cybersecurity community for  half-day of API Security-focused content, including expert speakers and panelists. While this isn’t the first time we’ve organized an event like this, it [...]

The post Chicago API Security Summit 2024 appeared first on Wallarm.

The post Chicago API Security Summit 2024 appeared first on Security Boulevard.

Insight #1: Don't shrug off this internet plague! Cross-site scripting (XSS) is the overlooked vulnerability plaguing the web. As Contrast’s
recent attack data show, it's everywhere, yet it’s often dismissed as “'low risk.” The truth? This prevalence makes XSS more of a threat, and it's easily exploited. Fortunately,
Application Detection and Response (ADR) is here to help you stop it!   Insight #2: Finding root cause doesn't always solve the problem 

Root cause analysis is not just about figuring out the technical problems that may have occurred, as Forbes describes. Technical problems rarely exist in isolation. They often occur within the context of a larger process or workflow. If that process is inefficient, it can create conditions that make technical problems more likely to occur, or harder to detect and fix.

  Insight #3: Fixing culture helps fix security  So many interesting interactions with peers over the last few months are making me realize that there is still a major disconnect between finding and fixing vulnerabilities and the culture that drives it. Too many security leaders don't care about culture and care more about resolving risk. But I would argue that creating a positive security culture will naturally help to address vulnerabilities faster (
mean time to respond/remediate [MTTR]) and create less vulnerabilities as time goes on (
vulnerability escape rate [VER]). Why can't we get over this hump?

The post Cybersecurity Insights with Contrast CISO David Lindner | 09/20/24 appeared first on Security Boulevard.

More than 2.1 million stolen VPN passwords have been compromised by malware in the past year, highlighting a growing risk for unauthorized access to secure networks, according to a Specops Software report.

The post More Than Two Million Stolen VPN Passwords Discovered appeared first on Security Boulevard.

Security issues stemming from the integration of information technology (IT) and operational technology (OT), could be addressed through artificial intelligence (AI), although the technology could also be leveraged by malicious actors, according to a Cisco study.

The post AI Could Help Resolve IT/OT Integration Security Challenges appeared first on Security Boulevard.

Nearly a third of companies hit by ransomware attacks paid ransoms four or more times in the past year, according to the Semperis 2024 Ransomware Risk report.

The post Companies Often Pay Ransomware Attackers Multiple Times appeared first on Security Boulevard.

The healthcare industry’s swift embrace of digital technologies is revolutionizing care delivery, but it also introduces new and potentially harmful cyber threats that could disrupt operations and jeopardize patient safety. As a result, cyber security in healthcare has become essential, playing a crucial role in protecting sensitive patient information and ensuring that healthcare services remain […]

The post Key Role of Cyber Security in Healthcare appeared first on Kratikal Blogs.

The post Key Role of Cyber Security in Healthcare appeared first on Security Boulevard.

On September 17 and 18, a series of devastating explosions rocked Lebanon, resulting in 37 fatalities and nearly 3,000 injuries, according to the Lebanese Minister of Public Health. Initial investigations suggest these attacks were not mere accidents but rather the result of a sophisticated cyber operation targeting communication devices. Understanding the Attack Experts indicate that […]

The post The Supply Chain Conspiracy: Cyber Attacks Behind the Lebanon Explosions appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post The Supply Chain Conspiracy: Cyber Attacks Behind the Lebanon Explosions appeared first on Security Boulevard.

Attacks on critical infrastructure  The explosion of the Soviet gas pipeline in 1982 was one of the first well-known instances of critical infrastructure being targeted through a software modification that contained a hidden malfunction. In this instance, the Soviets were stealing Western technology and the CIA slipped the flawed software to them without their knowledge. While the explosion itself didn’t cause any fatalities, it did cause some damage to the Soviet economy as per Washinton Post.      With the intensification of hybrid warfare, we have seen multiple attacks on ICS-based critical infrastructure in Europe and the Middle East. These attacks were designed not just to destabilize the systems but also to cause a major kinetic impact. No systems or assets are out of bounds today. State-backed actors from countries like North Korea are not just after technology and revenue but also act as conduits for other countries to infiltrate the critical infrastructure of their adversary nations.   Read more: Buyers guide to OT/ICS cybersecurity solutions A case study   In a recent instance, Sectrio’s Asset Research Team uncovered an anomaly in hardware supplied to a critical infrastructure operator. In this instance, same OEM supplied was supposed to supply the same hardware to two divisions of the same business. However, the hardware supplied to one entity, when examined, showed a deviation that was found to enable a backdoor communication with an obscure server using a now obsolete protocol that was sparingly used in the 90s.   The OEM in this case claimed that the anomaly was a generational remnant from an old version. How it made its way to only one piece of hardware and not the other is a question that was not answered to our satisfaction. The hardware belonged to the same batch and even had sequential serial numbers adding to the mystery.    This could be a genuine error but it is an error that could potentially be exploited by a bad actor.   Supply chain challenges As the Lebanon episode clearly showed, OEMs now have to ensure the integrity of their hardware well beyond their shop floors. ICS/OT operators should also watch out for anomalous behaviors and risky interactions that could jeopardize operations and plant safety levels. One way of offsetting these challenges is to ensure the systems undergo Security Acceptance Tests (SAT) along with Factory Acceptance Tests (FAT). This will ensure the integrity of the assets and call out any security issues before they are added to the infrastructure.   A ‘maker-checker’ approach is the way to go.   Recommended cybersecurity measures to risk-proof ICS assets  While IEC 62443 and NIST CSF-based risk assessment and gap analysis is a good place to start, the outcomes of such an assessment can and should be used across the enterprise to improve security posture. Here are some of the other steps that can be taken to secure ICS and OT assets and infrastructure:  Talk to us to learn how your crown jewels and assets can be protected through a custom-built ICS/OT cybersecurity plan. Contact us now! Book a consultation with our OT/ICS cybersecurity experts now. Contact Us  Thinking of an ICS security training program for your employees? Talk to us for a custom package.   

The post Exploding pagers and the new face of asset-centric warfare   appeared first on Security Boulevard.

Recent Cybersecurity regulations in the EU impact providers of digital products by setting down new requirements along the software supply chain. Our Cyber Resilience Act (CRA) checklist covers key elements of CRA and how the Sonatype platform enables compliance for your organization.

The post Tackle Cyber Resilience Act requirements with our CRA checklist appeared first on Security Boulevard.

The post What is Network Security Automation? appeared first on AI-enhanced Security Automation.

The post What is Network Security Automation? appeared first on Security Boulevard.

Providers of digital products and services to the EU are being impacted by a suite of new cybersecurity regulations coming into force. Among them is the Digital Operations Resilience Act (DORA), and we've developed a checklist to help you manage key components on your journey to compliance.

The post Sonatype can help you navigate DORA compliance appeared first on Security Boulevard.

Authors/Presenters:Wenxin Li, Xin He, Yuan Liu, Keqiu Li, Kai Chen, Zhao Ge and Zewei Guan, Heng Qi, Song Zhang, Guyue Liu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Flow Scheduling With Imprecise Knowledge appeared first on Security Boulevard.

If your organization is not already preparing to comply with the Cyber Resilience Act (CRA), now's the time to begin. This is a European-wide regulation, which means it will be implemented in the same way across all European Union (EU) member states. However, its practical application will impact anyone placing digital products or products with digital elements into the European market.

The post Compliance webinar series: Understanding the Cyber Resilience Act appeared first on Security Boulevard.