Ten posts into this series, something needs saying plainly, because the tooling tends to bury it: an inventory that only counts devices is incomplete by definition. Accounts are assets too.
They’re also the assets most likely to be duplicated across systems — the same person, four directories, four records, one human — which makes them the clearest case here for reconciling rather than aggregating. No amount of clever querying fixes a count built on duplicates.
An auditor will ask how many administrators you have. It’s a harder question than it sounds.
The User Inventory Challenge
A user inventory is more than just a list of names. It’s a complete catalog of every user account across an organization’s varied systems.
These accounts are the keys to your digital kingdom, serving crucial purposes in authentication, authorization, and accounting controls.
An accurate, comprehensive user inventory is fundamental to numerous administrative, operational, and security workflows.
Hurdles in User Account Management
Maintaining an up-to-date user inventory is no small feat. Here are some of the challenges cybersecurity professionals face:
- Fragmented ownership: Different systems and platforms are often managed by separate teams, leading to siloed information.
- Integration complexities: Developing and maintaining integrations with various data sources can be time-consuming and technically challenging.
- Rapid changes: User characteristics change frequently across multiple sources, making it difficult to keep information current.
- Inconsistent naming conventions: Varied naming conventions across systems make correlation rules complex and difficult to implement.
Given these challenges, many enterprises have settled for partial solutions, focusing on identity and access management (IAM) for their most critical applications. But in today’s complex digital landscape, is that enough?
Enter SJULTRA's Cybersecurity Observability Service
This is where SJULTRA’s CAASM services, becomes your incident response nitrous boost.
It’s like giving your security team a time machine and a crystal ball, all rolled into one.
CAASM pulls data from a smorgasbord of sources:
- Endpoint Agents
- Configuration and Patch Management Tools
- Ticketing & Helpdesk Platforms
- Networking Tools
- Vulnerability Assessment Tools
- IAM Solutions
- Cloud Infrastructure
By correlating this data, CAASM creates a rich, unified view of your entire digital ecosystem. It’s like having a digital map of your entire IT landscape, with every device, user, and cloud instance clearly labeled.
Technical Deep Dive
Let’s explore how to use SJULTRA CAASM to maintain an accurate user inventory:
Connect Data Sources
Directory services are an important baseline for users. They can help with user data correlation from other sources, simply because of the abundance of data objects typically populated in directory services. This could include a directory services platform like Microsoft Active Directory (AD) or cloud directory services like Microsoft Azure AD, AWS Directory Service, GSuite and OneLogin.
Identity and access management solutions are great sources because they are typically expansive in terms of enterprise-wide employee and user coverage and contain information about user security and access groupings, and access to specific applications and services.
Other common sources you can leverage to find information on users include:
- Digital management and intelligence tools, like DynaTrace and NextThink
- Third party intelligence sources like Shodan, Censys, HaveIBeenPwnd
- Privilege management tools, like CyberArk and BeyondTrust
- Configuration and patch management tools, like Chef, Jira, and SCCM
- Human resource management tools, like ADP, Workday and BambooHR
- Remote conferencing tools, like Zoom and Cisco Webex
Define Queries
By connecting CAASM to many data sources that contain user inventory data, these are the kinds of fields available to query and use to maintain your user inventory:
Find all admin users
This simple query will return ALL admin users from ALL data sources.
CAASM will now “normalize” all of this data such that you can see, for each user, on which systems they have admin rights.
Find Users and Devices breaking password policies
Using CAASM, you can interrogate the status of user accounts and passwords so you can check:
- If your password security policy is to rotate every 180 days: which users have not rotated passwords?
- If you mandate password access to all devices, which devices have accounts with passwords disabled?
This is how you “codify your security policy” by creating CAASM queries against all of your data sources, which is really devices and their configurations, and users.
The next step is to enforce the policy.
Taking action with CAASM enforcement actions
Any time a saved query surfaces user-related security concerns, security and risk teams can take actions including:
- Enable/disable users in Microsoft Active Directory
- Sending a Slack message with details to notify team members
- Creating a helpdesk ticket in ServiceNow, Jira, Zendesk, etc. to notify IT and security teams
- Adding a tag in CAASM for internal tracking purposes
- Enriching the user data with HaveIBeenPwnd to identify users in breaches, pastes and pwned passwords identified by the ‘Have I Been Pwned’ (HIBP) website.
Summary
Maintaining an accurate user inventory is crucial for robust cybersecurity and efficient operations. With SJULTRA CAASM, you can transform this challenging task into a streamlined, automated process.
Remember, this is just one of the 14 powerful use cases for CAASM. Stay tuned for our next installment to discover more ways to enhance your cybersecurity posture.
Ready to sort out your user inventory? Start your free trial of SJULTRA CAASM today!
documentation and Videos
Read the documentation: Maintain an accurate user inventory.
