1. Kevin Watson and Ammar Ammar IT Asset Visibility

2. The University of Tennessee Health Science Center What is Total Asset Visibility? Capability to provide users with timely and accurate information Capability to act upon that information to improve overall performance Location Movement Status Identity of units Personnel Equipment Material Supplies

3. The University of Tennessee Health Science Center Total Asset Visibility As applied to IT Hardware Software Endpoints Portable devices Servers Network/infrastructure devices “If it has an IP Address, it is an asset, and you need visibility into it.”

4. The University of Tennessee Health Science Center Why is it important? SANS 20 Critical Controls for an Effective Cyber Defense Without knowing what you have, you can’t effectively protect it Attackers continuously scan target organizations waiting on vulnerable systems to appear on the network Devices off and on the network Out of date devices New systems and applications

5. The University of Tennessee Health Science Center Foreign systems should be isolated to prevent compromises from affecting security Test systems Vender portables Personal assets Guest systems BYOD is becoming increasingly common

6. The University of Tennessee Health Science Center How do we do it? Managed control 1.Deploy and leverage asset discovery tool to build an inventory 2.Deploy dynamic host configuration protocol (DHCP) server logging 3.Ensure all IP enabled acquisitions update the inventory system as new, approved devices

7. The University of Tennessee Health Science Center 4.Inventory should include every system that has an Internet protocol (IP) address Network IP address(es) Hostname Function of system Asset owner, steward, and custodian Business units serviced Portable? Personal? 5.Use network level authentication via 802.1x and tie inventory data to determine authorized and unauthorized systems 6.Network Access Control (NAC) monitors authorized systems to facilitate remediation when necessary

8. The University of Tennessee Health Science Center How does this help the organization? Accounts for and manages inventory Network devices can be reconciled with the asset inventory Active scanning tools and passive listening tools can pair to improve detection of new or unauthorized devices Switches can be configured to implement 802.1x Only properly configured devices can connect to the network

9. The University of Tennessee Health Science Center Effectiveness Metrics Average time to detect a new devices Average time for scanners to alert the security administrators to unauthorized devices Average time to isolate/remove unauthorized devices Ability to identify location, department, and other critical details about the detected, unauthorized device SANS, http://www.sans.org/critical-security- controls/control/1

10. The University of Tennessee Health Science Center What tools can help?

11. The University of Tennessee Health Science Center Questions?

12. The University of Tennessee Health Science Center Contact information Kevin Watson 901-448-7010 Kevin.Watson@uthsc.edu Ammar 901-448-2163 aammar@uthsc.edu http://uthsc.edu/its/information-security