IT Governance and Cyber Security
When organizations think about IT governance and security, they often focus on protecting internal assets and data from external threats. But what if the threat originates from within the organization?
According to Cybersecurity Insiders’ 2020 Insider Threat Report, 70% of organizations say insider attacks are becoming more frequent. What’s more, 68% report feeling moderately or extremely vulnerable to insider attacks, and 56% believe detecting insider attacks has become harder since migrating to the cloud. These statistics point to a growing possibility of exposure to threat from the inside-out by an employee, contractor or partner.
Although organizations typically invest heavily in security at the perimeter to ensure no outside threats infiltrate the network, they often neglect to safeguard the network from inside threats. Complete protection both within and outside of the “four walls” hinges on comprehensive asset discovery and management.
In our first post in this series, we explored the importance of ITAM for IT governance, and reducing risk and spend. In this post, we’ll explore the idea of ITAM 2.0 — the next generation of IT asset management — and how the growing trend toward remote working due to COVID-19 has introduced IT governance challenges by widening the threat landscape. In our dedicated blog post on Remote IT Asset Management, you can find further tips and tricks on managing the new Work From Home situation from an IT perspective.
The Doors Are Locked, So How Did the Thief Get In the House?
You’re probably familiar with the “Trojan horse” — a type of malware disguised as legitimate software. Hackers trick users via social engineering and other tactics, and load the malware onto a user’s system to gain access.
When employees worked in the office, the bridge for the Trojan horse to cross was narrow and heavily guarded. Companies typically invest in multiple layers of firewall switches that can detect and prevent Trojan horses and other threats from getting in. Only the sales people were on the road, and they would occasionally connect to the corporate network from their laptops over secure VPNs. But as more and more people take their devices outside the four physical walls of the organization, the devices become vulnerable and start posing a threat to the company network.
Why? When employees connect their corporate laptops to home networks, they open new gateways for malware, ransomware and viruses. They may use their work computers for personal endeavors, such web surfing, gaming or viewing entertainment, for example. An employee may unwittingly click on an add or download an app, and open the door for malware. This can happen easily if the user has local admin rights. You need the right tools to find all local admins in your network.
Another major problem is that other devices that are not within the corporate IT department’s purview are often connected to the home network, providing a conduit for hackers to connect to corporate devices. The Internet of Things (IoT) further complicates the situation, as in many modern homes, numerous IoT devices — think Alexa or Echo, smart heating systems and appliances, or video doorbells — are also connected to the home network. Most households have streaming boxes such as Apple TV, Amazon Fire TV or Roku, as well. IT Departments need to realize that the home network is becoming an important attack vector. In our blog post on securing the remote workforce, we give you some tips to combat this.
IoT devices have operating systems with software running on top, and although hackers usually have no interest in attacking someone’s home network, they can leverage these devices, drawing on their processing power or using the devices as soldiers in the hacker’s war to enter an organization. Malware can live undetected on a home computer or IoT device for days or weeks, building momentum before launching a large-scale attack, causing devastating damage and potential financial losses for the organization. Read more tips on protecting your network devices from ransomware & our top 10 cybersecurity tips for 2021 for more information on cybersecurity.
A Broader Approach to IT Governance
Until March of 2020, only 3.4% of the workforce in the U.S. worked from home on a regular basis. By April, about 20% of all U.S. employees were signing on from home, and for many organizations, 100% of their employees began working remotely overnight. Given this new, distributed IT environment, it’s essential that organizations know and monitor what goes on behind the firewall, as well. What assets are connected to the network? Who’s using them? How are they being used? Do they have the appropriate protections and up-to-date software installed? Are there vulnerabilities?
To answer these questions, organizations must progress beyond point solutions that address isolated aspects of IT governance, such as security. According to Roel Decneut, CMO at Lansweeper, having the right data is critical. “Security isn’t limited to your workstations, servers and network components — it’s far broader,” he said. “There are plenty of tools for a variety of ITAM related scenario’s; but each focuses on the subset of Assets that is relevant for their use case; leaving customers with either too little, or too much data; and still no control.
IT governance in today’s environment requires maintaining a single source of truth that contains the depth and breadth of data necessary for all scenario’s, including security outside and within the corporate perimeter.”
Roel Decneut, CMO of Lansweeper
ITAM 2.0: Inside, Outside, Anywhere Your Assets Are
Lansweeper enables organizations to rise to the challenge of ITAM 2.0, and protect their corporate networks using a bottom-up approach. With our IT Discovery & Inventory solution, organizations can collect, analyze and report on every IT asset within and outside of the four walls in real-time, at any time and for any use case, and gain unprecedented insight into the health and security of the entire infrastructure.
Having this information alerts IT to any potential vulnerabilities on unprotected networked devices that could pose a threat to corporate data and assets — a capability that’s especially important now that the majority of the workforce is remote.
The basic premise of good cybersecurity is that you can’t protect what you can’t see. So the critical first step when it comes to basic cyber hygiene is to maintain visibility of your IT environments and develop the relevant daily routines to inspect and verify.
In terms of IT Governance, a single source of truth for all IT assets connected to the network is essential for compliance. Lansweeper reveals in easy-to-understand terms what devices have outdated antivirus software, OSes or other vulnerabilities that could open the door to malware or other threats.
“As opposed to scenario specific tools that collect highly technical information on a subset of assets, Lansweeper reports can be tailored for different business audiences, providing detailed data and actionable insight to IT staff, so they can perform necessary updates and patches. Additionally it generates high-level reports tailored for CFOs and CEOs, to keep them informed at all times, without bogging them down with technical details.”
Roel Decneut, CMO of Lansweeper
Better Governance and a Stronger Security Posture
Securing the perimeter and valuable company & customer data will always be a critical function of enterprise IT organizations, and is necessary for complying with the various IT governance frameworks and regulations, such as COBIT, NIST, ISO and more. But IT governance can’t be limited to protecting your organization against external threats. Some of the worst, more damaging attacks come from the inside — the Trojan Horse that has already infiltrated your four walls. ITAM 2.0 takes into account our new reality: corporate assets are everywhere and can be connected to networks that contain vulnerable devices.
“Only with a complete, 360-degree view of your IT infrastructure can you detect and protect corporate assets and your organization from the ever-evolving and rapidly expanding threat landscape,” said Decneut.
“Lansweeper provides that single source of truth — a complete and always-accurate asset inventory — as well as the insight and reporting capabilities to enable effective, consistent and ongoing IT governance.”
Roel Decneut, CMO of Lansweeper
In our final installment in this 3-part blog series on IT Governance, we’ll delve deeper into the complexities of OT devices and their impact on enterprise asset management and security.
To learn more about how Lansweeper’s being used in the real world, read some of our customer success stories, which demonstrate how organizations such as Cerner, Herman Miller, and Breitenfeld Edelstahl AG are leveraging our technology to enhance their cybersecurity.
Get Instant Access to ITAM Insights
Stay current with the latest insights on IT Asset Management.
"*" señala los campos obligatorios