2023: The Year of Cybersecurity
How to Get Ahead of Attackers this Year with Updated Inventories
3 . . . 2 . . . 1 . . . HAPPY NEW YEAR! 2023 has arrived and with the new year comes resolutions, fresh starts, and of course starting new projects. In this article, we will be covering one of the most essential projects your district technology team should be working on this year, updating and maintaining your district’s hardware and software inventories.
Now, I’m sure you were hoping for some magical new idea or process that would cut ticket numbers in half or solve that one nagging issue that doesn’t seem to ever get fixed but, while not particularly exciting, hardware and software inventories are essential tools for successful district technology teams. Trust me, I know from first-hand experience that the reality is this “new project” is relatively unexciting and time-consuming. However, inventories, both software and hardware, are key pieces in maintaining and securing our district’s environments because while you may think you know what technology is in your district until you accurately account for all of the technology in your environment you will never 100% know what technology is actually in the environment.
The first time I was tasked to create a hardware inventory at a district I worked in, I didn’t understand the importance of what it was I was doing. Sure it’s good to know what devices are in the district, but it didn’t seem like it should have been an urgent priority. In fact, it wasn’t until after I had created the full inventory and began to use it in day-to-day tasks that I understood the importance and convenience of a completed and updated inventory system. Ultimately, what I learned from this experience is that hardware and software inventories allow you to have greater visibility into your network in order to create an overall picture of both the devices and software in your environment that your district technology team can then use in several different ways. Hardware inventories can help us understand the number of devices, the age of those devices, which person has what device, the different operating systems, and the different operating system versions in our environments along with any other data points we wish to track. Additionally, hardware inventories can help with purchasing and budgeting by tracking hardware lifecycles and end-of-life devices. Likewise, software inventories can help us know what software is installed, which software versions are installed, what software is installed on which device, and many other associated data points. Data from the software inventory can also be incredibly useful when a new software vulnerability is discovered as attackers commonly use software vulnerabilities to gain initial access to a device or account, escalate privileges from a regular user to an administrator, exfiltrate data from the compromised network, and any other malicious activities they can leverage through the compromised software.
Now that we have established the need for a hardware and software inventory for our district, how do we get one started? Oftentimes when talking to district technology leaders about hardware and software inventories there is a hesitancy to start the process because the task can be so big it’s hard to know where to start or what to track. After walking multiple districts through this process, I can honestly say the easiest way to start is by opening up an excel or google spreadsheet and start recording information about what hardware and software are in the district and to who it is assigned. For hardware inventories recording information such as make, model, operating system, asset tag, serial number, MAC address, and the assigned user is a great starting point. For software inventories recording information such as publisher, version number, operating systems, architecture, licensing information, installer information, and assigned user is another great starting point.
If you already have a hardware and software inventory in production make sure there is a policy and process in place for continuous updating of those inventories. If the inventory is not reasonably up to date it is essentially useless. It is recommended that the inventories are to be updated whenever there is a change to be documented, like the addition or removal of hardware in the environment, updated software deployment packages, and reassigning or redistributing hardware assets to staff members or students. Maintaining hardware and software inventories is just as important as creating them.
One additional important item to address regarding hardware and software inventories is to remember that these spreadsheets will contain important information about your district, so it is necessary to have them protected either with a password or behind some sort of encrypted drive that lets you control who has access to the documents, like Google Drive or Microsoft One Note. For added security, it is also recommended to add an ACL, Access Control List, to these documents to limit both viewing and editing access to the documents. Beyond a simple spreadsheet, there are some great free tools such as Snipe-IT and Spiceworks Inventory Management. If you’re looking to up your game to a paid solution there are a lot of different software and software vendors out there, most of which come with a trial period for you to test out the solution in your environment.
Finally, now that we have a solid understanding of what hardware and software inventories are and how to create and maintain them, it’s time for the hardest part. It’s time to get started.
From all of us here at Forward Edge, we wish you a Happy New Year!