{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/asset-inventory","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/asset-inventory/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/asset-inventory/"},"term":{"en":"Asset inventory","da":"Aktivfortegnelse (asset inventory)"},"aka":{"en":["IT asset inventory","asset register"],"da":["asset inventory","aktivliste"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","summary":{"en":"One complete, up-to-date list of the organisation's computers, devices, systems and software.","da":"En samlet, opdateret liste over virksomhedens computere, enheder, systemer og software."},"body":{"formal":{"en":"A maintained record of every hardware and software item the organisation owns or runs, with an owner, location and purpose for each, kept current as things are added or removed.","da":"En vedligeholdt fortegnelse over alt udstyr og al software, virksomheden ejer eller driver, med ejer, placering og formål for hver enkelt, som holdes ajour, når noget tilføjes eller fjernes."},"plain":{"en":"Like the list a household makes for home insurance - you cannot protect or claim for what you do not know you have.","da":"Som den liste over ting i hjemmet, en familie laver til forsikringen - man kan ikke beskytte eller få erstatning for noget, man ikke ved, man har."},"inPractice":{"en":"At a small water utility, the IT lead checks the office network and finds three laptops and a file-sharing app nobody had listed; each gets an owner and joins the same update routine as everything else.","da":"Hos et vandværk tjekker den IT-ansvarlige kontorets netværk og finder tre bærbare og en fildelingsapp, som ingen havde registreret; hver får en ejer og kommer ind under samme opdateringsrutine som resten."},"whyItMatters":{"en":"Every other control depends on it - forgotten machines are never updated or watched, and that is exactly where attackers get in.","da":"Alle andre kontroller afhænger af den - glemte maskiner bliver hverken opdateret eller overvåget, og det er netop dér, angribere kommer ind."}},"deepDive":{"en":"An asset inventory is a reconciliation problem rather than a list-keeping problem. No single source sees everything, so mature programmes merge several: directory services (Active Directory, Entra ID), MDM/UEM and EDR agent consoles, DHCP and DNS logs, switch ARP and CAM tables, active network discovery scans, passive traffic analysis (the only safe method on many OT networks, where active probing can crash PLCs), cloud provider APIs, virtualisation managers and purchasing records. Each record is keyed on something stable - serial number, MAC address, cloud instance ID, agent ID - and the interesting output is the delta: devices seen on the network but not in the inventory are unmanaged or rogue, and inventory entries not seen for weeks are stale or lost. Tools that do this correlation are marketed as cyber asset attack surface management (CAASM).\n\nCIS Controls v8 puts this first for a reason. Control 1 (enterprise assets) asks for a detailed inventory reviewed at least bi-annually (Safeguard 1.1) and a process to deal with unauthorised assets weekly (1.2); Control 2 does the same for software, including an allowlist-based approach at higher Implementation Groups. ISO/IEC 27002:2022 control 5.9 (inventory of information and other associated assets) additionally requires an identified owner for each asset, and NIS2 Art. 21(2)(i) lists asset management among the mandatory measures. The owner field matters more than it looks: without it, vulnerability findings, end-of-life decisions and risk acceptances have nobody to route to.\n\nSoftware inventory has moved from \"which applications are installed\" towards component-level transparency. A software bill of materials (SBOM), in SPDX or CycloneDX format, lists the libraries inside a product, which is what lets an organisation answer \"where do we run a vulnerable Log4j version?\" in hours rather than weeks. The EU Cyber Resilience Act makes SBOMs a manufacturer obligation for products with digital elements, on a timeline that runs to the end of 2027.\n\nCommon failure modes: treating the CMDB (a configuration model built for IT service management, with relationships between configuration items) as a security inventory without checking its completeness; missing ephemeral cloud workloads and containers that live for minutes; ignoring SaaS subscriptions bought on credit cards (shadow IT); and forgetting non-traditional endpoints such as printers, IP cameras, building-management controllers and conference-room systems. The measure of quality is coverage - the share of observed devices that are known and owned - not the length of the list.","da":"En aktivfortegnelse er i virkeligheden et afstemningsproblem snarere end et spørgsmål om at føre en liste. Ingen enkelt kilde ser alt, så modne programmer fletter flere sammen: katalogtjenester (Active Directory, Entra ID), MDM/UEM- og EDR-konsoller, DHCP- og DNS-logs, switchenes ARP- og CAM-tabeller, aktive netværksscanninger, passiv trafikanalyse (den eneste sikre metode på mange OT-netværk, hvor aktiv scanning kan få PLC'er til at gå ned), cloududbydernes API'er, virtualiseringsplatforme og indkøbsdata. Hver post nøgles på noget stabilt - serienummer, MAC-adresse, cloud-instans-ID, agent-ID - og det interessante resultat er differencen: enheder, der ses på netværket, men ikke står i fortegnelsen, er uadministrerede eller uautoriserede, og poster, der ikke er set i ugevis, er forældede eller forsvundne. Værktøjer, der laver denne korrelation, sælges under betegnelsen cyber asset attack surface management (CAASM).\n\nCIS Controls v8 placerer emnet først med god grund. Control 1 (virksomhedens aktiver) kræver en detaljeret fortegnelse, der gennemgås mindst to gange om året (Safeguard 1.1), og en proces, der håndterer uautoriserede aktiver ugentligt (1.2); Control 2 gør det samme for software, på de højere Implementation Groups med allowlisting. ISO/IEC 27002:2022 kontrol 5.9 (fortegnelse over information og andre tilknyttede aktiver) kræver desuden en udpeget ejer for hvert aktiv, og NIS2 art. 21, stk. 2, litra i, nævner forvaltning af aktiver blandt de obligatoriske foranstaltninger. Ejerfeltet betyder mere, end det ser ud til: uden det har sårbarhedsfund, end-of-life-beslutninger og risikoaccept ingen modtager.\n\nSoftwarefortegnelsen har bevæget sig fra \"hvilke programmer er installeret\" mod gennemsigtighed på komponentniveau. En software bill of materials (SBOM) i SPDX- eller CycloneDX-format viser bibliotekerne inde i et produkt og gør det muligt at svare på \"hvor kører vi en sårbar Log4j-version?\" på timer frem for uger. EU's Cyber Resilience Act gør SBOM til en pligt for producenter af produkter med digitale elementer, med en tidsplan, der løber frem til udgangen af 2027.\n\nTypiske fejl: at bruge CMDB'en (en konfigurationsmodel bygget til IT-servicestyring med relationer mellem konfigurationselementer) som sikkerhedsfortegnelse uden at efterprøve dens fuldstændighed; at overse kortlivede cloud-workloads og containere, der kun eksisterer i minutter; at ignorere SaaS-abonnementer købt på firmakort (skygge-IT); og at glemme utraditionelle endpoints som printere, IP-kameraer, bygningsautomatik og mødelokaleudstyr. Kvaliteten måles på dækning - andelen af observerede enheder, der er kendte og har en ejer - ikke på listens længde."},"edges":[{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/shadow-it","why":{"en":"Regularly comparing what is found against the list exposes apps and devices nobody approved.","da":"Når man jævnligt sammenligner det fundne med listen, afsløres apps og enheder, som ingen har godkendt."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/endpoint","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/vulnerability-scanning","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Controls 1 and 2","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}