IT Asset Management (ITAM) and Cybersecurity: Inventory Everything

“You can’t protect what you don’t know you have.” - this principle is the foundation of every security strategy. IT Asset Management (ITAM) ensures that companies maintain a complete, up-to-date overview of all IT assets: hardware, software, cloud resources, licenses, and their dependencies.

Why ITAM Is the Foundation of Every Security Strategy

The unpatched asset problem:

Scenario: Ransomware attack in October 2024

• Entry point: CVE-2024-XXXX in Windows Server 2012 R2
• Question: "Do we still have Windows 2012 R2 systems?"
• Answer without ITAM: "We don't think so..."
• Reality: 3 forgotten VMs in the basement ESXi

Why does this happen?

• Organic IT growth over the years
• No structured handover during staff turnover
• Shadow IT: Departments make purchases without the IT department
• Cloud sprawl: Teams create EC2 instances, then forget about them
• Virtualization: VMs are cloned, renamed, and forgotten

CIS Controls 1 and 2 require exactly that:

• Control 1: Inventory and control of enterprise assets
• Control 2: Inventory and control of software assets

ITAM gaps = security gaps: Unknown asset → no patch → known CVE → attack

Statistics:

• 20% of IT assets in medium-sized companies are not inventoried (Freshservice State of IT, 2023)
• 67% of ransomware attacks exploit unpatched known CVEs (IBM X-Force, 2024)

CMDB - Configuration Management Database

CMDB Concept (according to ITIL):

Configuration Item (CI):

• Any asset that is managed
• Has attributes: Name, Type, Version, Owner, Location, Status
• Types: Hardware, Software, Service, Document, Certificate

CMDB Structure Example:

Relationships in the CMDB:

• web-prod-01 → uses → nginx:1.24 (Software)
• web-prod-01 → connected-to → db-cluster-01 (Server)
• web-prod-01 → hosted-on → esxi-host-02 (if VM)
• nginx:1.24 → has-vulnerability → CVE-2023-44487 (HTTP/2 Rapid Reset)

CMDB Tools:

Open Source:

• iTop (CMDB + ITSM, free)
• Ralph (excellent open-source ITAM tool)
• NetBox (network/data center-focused)
• Snipe-IT (asset tracking, very user-friendly)

Commercial:

• ServiceNow CMDB (enterprise standard)
• Freshservice CMDB (SME/mid-market)
• Lansweeper (very good for automatic discovery)
• Device42 (CMDB + Discovery + Dependency Mapping)

Automatic Asset Discovery

How to find assets you don't know about:

Network scan-based discovery:

Nmap for basic inventory:

# Discover all active hosts on the network
nmap -sn 10.0.0.0/16 -oX discovery.xml

# Identify operating system and services
nmap -O -sV 10.0.0.0/16 -oX inventory.xml

# Only specific ports (faster for large networks)
nmap -p 22,80,443,3389,445 10.0.0.0/16 --open

# Output to CSV for Excel/import
nmap -p 22,80,443 10.0.0.0/16 -oG - | \
  awk '/Up/{print $2}' > live-hosts.txt

Nessus Essentials (free for up to 16 IPs):

• Combined vulnerability scan + asset discovery
• Identifies OS, patches, services, configuration issues
• Export as CSV/XML for CMDB import

OpenVAS (free, unlimited):

• Comprehensive vulnerability scanner
• Asset discovery as a byproduct
• Regular updates to the vulnerability database

Agent-based discovery:

• Lansweeper Agent: installed on endpoints
• Regularly sends complete hardware/software inventory
• Also finds assets behind NAT / in remote offices

Cloud asset discovery:

# AWS:
aws ec2 describe-instances --query \
  'Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress,PrivateIpAddress,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# Azure:
az resource list --output table

# GCP:
gcloud compute instances list

Multi-Cloud tools: Prisma Cloud (all clouds in a single overview), Wiz (Cloud Asset Inventory + Risk Assessment), AWS Security Hub + Azure Security Center combined.

Software Asset Management and SBOM

Software Inventory - why it's so important:

Software inventory minimum requirements:

• Name and version of every installed application
• License information (compliance!)
• Patch status and known CVEs
• Installed for whom? (Asset association)
• Installation date and last update

Automatic software inventory:

Windows (WMI/PowerShell):

wmic product get Name, Version, InstallDate, InstallLocation

# Via PowerShell (all installed programs):
Get-WmiObject -Class Win32_Product | Select Name,Version,Vendor |
  Sort Name | Export-Csv software-inventory.csv

# Better: Also from the registry:
Get-ChildItem HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall |
  Get-ItemProperty | Select DisplayName,DisplayVersion,Publisher |
  Sort DisplayName

Linux (Debian/Ubuntu):

dpkg --list | awk '{print $2, $3}' > software-inventory.txt

# RPM (RHEL/CentOS):
rpm -qa --queryformat '%{NAME} %{VERSION}\n' > software-inventory.txt

SBOM (Software Bill of Materials):

What is SBOM?

• Complete inventory of all software components
• Includes all libraries and their dependencies
• Standard formats: SPDX (ISO/IEC 5962), CycloneDX
• Mandatory under a U.S. Executive Order (May 2021) for U.S. government software
• Increasingly expected in the EU under NIS2 and the CRA (Cyber Resilience Act)

Generate an SBOM with Syft:

# Scan a Docker image:
syft myapp:latest -o spdx-json > sbom-myapp.json

# Scan a source code repository:
syft dir:./src -o cyclonedx-json > sbom-source.json

# Check SBOM for vulnerabilities with Grype:
grype sbom:./sbom-myapp.json
# Shows: all known CVEs in dependencies!

Log4Shell lesson: "Am I using log4j?" - Without SBOM: weeks of manual searching. With SBOM: grep "log4j" sbom-*.json → immediate answer.

Hardware Lifecycle Management

Hardware Lifecycle and Security Risks:

End-of-Life (EOL) / End-of-Support (EOS):

EOL means: no more security patches! Every known vulnerability remains permanently unpatched.

Critical EOL dates (2026):

ITAM Process for EOL Management:

1. Record all assets with OS/software version in CMDB
2. Automatically load EOL data from vendor feeds
3. Trigger alert when < 12 months until EOL
4. Budget planning: Allocate budget for migration/replacement
5. Document exceptions + accept risk + mitigate

Hardware replacement cycle:

Why short cycles? Hardware security vulnerabilities:

• Spectre/Meltdown: Hardware firmware update required
• Log4Shell on embedded devices: rarely patchable
• Older hardware: no TPM 2.0 → no Windows 11, no BitLocker
• IoT devices: often no security updates after 2-3 years

ITAM for Compliance

ITAM requirements in standards and laws:

ISO 27001:2022:

• A.5.9: Inventory of information and other assets - "Complete and up-to-date inventory", classification based on protection requirements
• A.5.10: Acceptable use of information and other assets - usage rules for classified assets
• A.5.11: Return of assets - exit procedure: return all assets!

NIS2 Art. 21: "Assets and risks must be known" - complete asset inventory as a basis.

BSI IT-Grundschutz: ORP.1: Organization - asset inventory explicitly required.

Audit documentation - what auditors want to see:

• Complete asset inventory (< 6 months old)
• Asset owners for all critical assets
• Classification by protection requirements
• EOL/EOS management documented
• Process for new assets (onboarding) and old ones (decommissioning)
• Regular review (frequency documented)

Quick-win checklist:

• Create inventory table (asset, owner, OS, version, IP)
• Nmap scan against your own network: what unknowns are found?
• Windows WSUS / SCCM: how many devices are missing patches?
• Identify all devices that haven't been updated in > 90 days
• EOL check: which OS/software is running out of support?