Get to full asset inventory by combining active scanning with API integrations - Part 4

CISA BOD 23-01 blog series

This is the final part of our 4-part CISA BOD 23-01 series. Check out part 1 to start at the beginning of the series.

A combination of integrations and active scanning works best #

No single approach can get to full asset inventory across IT and OT, on-premise and cloud, and your remote workforce. However, a combination of active scanning plus integrations usually covers all areas.

You need breadth and depth for asset inventory. Breadth means enumerating all of the devices. Depth means knowing as much as possible about each device.

Active scanning API integrations
Breadth (enumeration) Depth (detail) Breadth (enumeration) Depth (detail)
Managed IT
Unmanaged IT
Remote workforce

Breadth: Enumerating all assets #

Active scanning is the fastest way to get breadth. Start with the networks you know about, then look around the edges to see what’s hiding in the shadows. To discover all devices and subnets, do a full RFC 1918 scan, then find unmapped assets that were seen through SNMP but not reached directly to see where you are missing subnets.

Active scanning can be used for cloud environments and remote work, but getting to breadth is usually better achieved through integrations with cloud hosting providers, EDR, MDM, and productivity suites (e.g., Google Workspace).

Depth: Getting detailed information on all assets #

Next, let’s focus on depth. For managed devices, you can typically get a lot of depth with integrations with EDR, MDM, and productivity suites. However, you’ll get nothing at all for unmanaged IT. A scanner that does not require authentication and is purpose-built for asset inventory, such as the runZero Explorer, will give you the best depth you can get for unmanaged devices, IoT, and OT.

Asset inventory for cloud environments #

For cloud integrations, you’ll typically start out with an API integration, which gives you both breadth and depth. However, active scanning can give you more depth in certain areas, such as open ports, service protocols, and operating systems.

Consider AWS EC2 for example, where each approach delivers only part of the details:

Asset detail Active scanning API integrations
IPv4 address
IPv6 address
MAC address
Open ports (from VPC & internet)
Service protocols
Operating system
Installed software
Account ID
Availability zone
Image ID
Instance type
Root device name
Subnet ID

Asset inventory for your remote workforce #

For your remote workforce, both breadth and depth will come from integrations. Typically, the following sources are the most helpful, although one source is typically sufficient:

  • EDR agents, such as CrowdStrike and SentinelOne
  • MDM solutions, such as Microsoft Intune and Miradore
  • Productivity suites, such as Google Workspace
  • Directories, such as Microsoft Active Directory and Azure AD

Correlate all data sources to identify security coverage gaps #

Having the breadth of all assets, especially through active scanning, and information on security controls via integrations, enables you to find security coverage gaps, such as:

  • All machines missing EDR agents
  • Subnets missing vulnerability management coverage
  • Devices not covered by MDM

Options if you already have an integration-based CAASM solution for asset inventory #

If you have already rolled out an integrations-based asset inventory solution without active scanning, you have options:

  • Add active scanning to your existing CAASM solution: Use runZero Professional Edition to scan your network, then use the export API to feed the data into other CAASM solutions. runZero has existing integrations with Axonius and JupiterOne.
  • Replace existing CAASM solution: Use runZero Enterprise Edition to have a single solution that includes active scanning and integrations with key sources. This approach may be favorable if you are trying to consolidate solutions and reduce cost.

Written by Chris Kirsch

Chris Kirsch is a co-founder of runZero. Chris started his career at an InfoSec startup in Germany and has since worked for PGP, nCipher, Rapid7, and Veracode. He has a passion for OSINT and Social Engineering. In 2017, he earned the Black Badge for winning the Social Engineering Capture the Flag competition at DEF CON, the world’s largest hacker conference.

More about Chris Kirsch
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Product Release
Introducing the customizable dashboard, Wiz integration, and more!
Introducing the customizable dashboard, Wiz Integration, and other Q2 2024 enhancements to the runZero Platform.
Product Release
How to integrate your SIEM platform with runZero to create an actionable asset inventory
Learn how to combine runZero's real-time asset inventory with SIEM exports for comprehensive asset tracking and historical data analysis..
runZero Insights
Celebrating Women’s History Month with trailblazers & innovators
It’s Women’s History Month! runZero is celebrating all month long by highlighting innovative women who have been technological trailblazers.
Upcoming NYDFS regulatory requirements on asset inventory and vulnerability enumeration
Is your business prepared for the approaching deadlines for complying with the latest version of the NYDFS Cybersecurity Regulation (23 NYCRR 500)?...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved