Owasp Infrastructure

title: 'ISR10: Insufficient Asset Management and Documentation' description: OWASP Infrastructure Top 10 reference for asset management vulnerabilities including incomplete inventories and missing documentation

10 Insufficient Asset Management and Documentation

Identifier: ISR10:2024 Category: Governance

Description

Insufficient asset management refers to shortcomings in an organization's ability to accurately identify, track, and document all its hardware and software assets, along with associated configurations, dependencies, and lifecycles. It encompasses the lack of an organized and up-to-date inventory of IT assets, which is essential for effective security, compliance, and operational efficiency. A complete asset inventory enables fast mapping of affected resources and accurate incident response.

Risk

• Unauthorized or unmanaged devices and software within the network make it difficult to enforce security policies and monitor for vulnerabilities effectively.

• Incident response capabilities are hampered because the organization may struggle to identify the scope and impact of a security incident or breach.

• Compliance with industry regulations and internal policies becomes challenging, exposing the organization to legal and financial liabilities.

• Inefficient resource allocation results in overspending on redundant assets or underinvesting in critical IT infrastructure.

Vulnerability checklist

• No complete inventory of hardware and software assets exists.

• Asset inventory is not continuously updated to reflect changes in the environment.

• Assets are not classified by criticality and function.

• No lifecycle management process exists for procurement, deployment, maintenance, and disposal.

• Regular audits and vulnerability scanning cycles are not conducted.

• Process, responsibility, and implementation documentation is incomplete or absent.

Prevention controls

1. Develop and maintain a complete inventory of all hardware and software assets, including servers, workstations, mobile devices, applications, and network equipment; continuously update this inventory.

2. Categorize assets based on criticality and function to prioritize security measures and resource allocation.

3. Implement a systematic approach to asset lifecycle management, including procurement, deployment, maintenance, and disposal; securely decommission or renew outdated assets before they become a security risk.

4. Conduct regular audits and reconciliation of the asset inventory to identify discrepancies, including regular vulnerability scanning cycles.

5. Provide accurate documentation describing all IT and business processes, corresponding responsibilities, and technical details.

Example attack scenarios

Scenario A — Undetected vulnerabilities

An organization has a vast and complex IT infrastructure. Due to a lack of systematic vulnerability scanning and asset management, the IT team is unaware of accumulating security weaknesses. Attackers exploit undetected vulnerabilities to gain unauthorized access, disrupt operations, or exfiltrate sensitive data. As the organization expands, the risk associated with these undetected vulnerabilities grows.

Scenario B — Incident response with good asset management

An incident response team confronts a critical security breach where attackers exploited a software vulnerability in the corporate platform, compromising webservers and creating an entry point to the internal network. Due to accurate and up-to-date asset documentation, the team quickly identifies critical systems, maps affected resources, defends weaknesses, and prevents significant data breaches. Damaged systems are rebuilt without extended disruption.

Detection guidance

• Compare deployed assets against the maintained inventory for discrepancies.

• Scan for unknown or unauthorized devices and software on the network.

• Review asset lifecycle records for items past end-of-life or end-of-support.

• Audit documentation completeness for IT processes, responsibilities, and technical details.

Remediation

• Conduct a full asset discovery and build a comprehensive hardware and software inventory.

• Classify all assets by criticality and function.

• Establish lifecycle management processes covering procurement through secure disposal.

• Schedule recurring inventory audits and automated vulnerability scanning.

• Create and maintain documentation for all IT processes, responsibilities, and configurations.

• Assign ownership for inventory accuracy and documentation currency.