Hacking has become a major concern for organisations, but can managing assets help combat breaches?
Network breaches have unfortunately become too common over the past few years, with the Sony Pictures hack in 2014 being one of the most famous that springs to mind. Another example can be found in a report from IT security firm Mandiant, which says that hundreds of terabytes of data have been stolen from over 140 organisations worldwide by just one hacking group.
Investigating and clearing up after this type of breach can be time consuming and costly, so preventing this from happening or at least cutting down on the chance of it happening is a sensible idea.
One way an IT manager responsible for software asset management (SAM) can help improve security is by working with SAM and security professionals to identify and remove entry points into the infrastructure that hackers use.
The good news is that there are a number of ways in which software asset management can be used to lower the level of risk without having to put in extra (and costly) security restrictions.
First of all, consider out-dated and old software. While for the IT asset manager this is a minor concern (a software vendor is unlikely to audit your use of software that is years old), leaving it running in the infrastructure can lead to a network breach. According to an article in Fast Company, hackers managed to obtain a list of applications JPMorgan Chase used on its computer and sift through that list looking at each piece of software and their known vulnerabilities. Vulnerabilities that led to the compromising of some 83 million bank accounts.
Best to think of it like this: Any old or unused software not removed from computers, could end up being a very expensive liability in the enterprise environment. Removing unwanted software not only improves your posture with regards to potential audits, but also produces very real security benefits too.
Second, software asset management can be used to validate that software is patched and updated regularly. These patches fix security vulnerabilities that software has. If it is unpatched an organisation should consider it unsafe. According to the Verizon Data Breach Investigations Report (DBIR) for 2015, 99.9% of the exploited vulnerabilities were compromised more than a year after the common vulnerabilities and exposures (CVE) was published.
The point here is that if you didn’t know that your webserver was vulnerable to the Heartbleed flaw because you didn’t know what version of software the webserver was running, you can be sure a hacker would have known. Indeed, according to a report by Bloomberg, half of the Forbes Global 2000 companies have servers running on the internet that were unpatched against this flaw six months after the software was patched.
By utilising software asset management, it would be easy to create an inventory exception report that finds operating systems or applications running at a version level or below or if an update has been applied or not.
Third, a software policy has to be enforced. Employees will use any means at their disposal to get their job done. More often than not, this means using software brought from home or downloaded from the internet if they can’t buy the licenses they need.
Another thing to consider here is whether or not users have admin rights. Does your company have processes in place to stop rogue software from installing? Will they install Libre Office because you haven’t installed Microsoft Office?
While software isn’t inherently risky if downloaded from a trusted source, knowing what software is safe, where to safely download it and making sure that software stays patched against vulnerabilities is essential to cutting down the risk to organisations from hackers.
This can be remedied by allowing staff to make requests for software they need without the trouble of finding the software, making sure licenses are purchased and the software is genuine. Providing an in-house app store will make the system of managing the process of buying, approval, delivery and installation automatic. The app store can include any type of software.
By following these three steps, your organisation can improve its security posture using its investments in software asset management rather than buying costly security products. Using the tools you already have in conjunction with a trusted SAM provider could help prevent your company from being a victim of a network breach.