Chapter 22 — Systems, endpoints and hardware security: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Why it matters"]
N2["Lab — inventory comparison"]
N3["22.2 Reading the result"]
N4["22.3 Investigating"]
N5["22.4 Fixing"]
N6["Keeping the inventory current"]
N7["Resolving the differences"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Why it matters"]
N2["Lab — inventory comparison"]
N3["22.2 Reading the result"]
N4["22.3 Investigating"]
N5["22.4 Fixing"]
N6["Keeping the inventory current"]
N7["Resolving the differences"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Why it matters]
|
v
[Lab — inventory comparison]
|
v
[22.2 Reading the result]
|
v
[22.3 Investigating]
|
v
[22.4 Fixing]
|
v
[Keeping the inventory current]
|
v
[Resolving the differences]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) compare the asset register with management agent reports; (2) find unmanaged and unregistered devices; (3) fix dependencies.
22.1 Why it matters
Every control depends on the management agent. A device not reporting gets no settings, updates or monitoring. CIS Controls v8 begins with inventory for this reason.
The model already shows the risk: the management server reported three servers when four exist. A laptop whose agent is broken is invisible in the same way, so encryption, updates and the baseline checks all miss it. Aisha's comparison lab tests whether every registered device is reporting, and whether every reporting device is known.
Lab — inventory comparison
"""Compare the asset register with devices reporting to the management agent (synthetic, stdlib only)."""
register = {f"BHA-L{i:02d}" for i in range(1, 46)} | {"BHA-S01", "BHA-S02", "BHA-S03", "BHA-S04"}
reporting = (register - {"BHA-L07", "BHA-L19", "BHA-L33", "BHA-S04"}) | {"DESKTOP-7F2K", "BHA-L46"}
print(f"register {len(register)}, reporting {len(reporting)}")
print("in register, not reporting:", ", ".join(sorted(register - reporting)))
print("reporting, not in register:", ", ".join(sorted(reporting - register)))
Run with python3 lab_inventory.py. Verified output:
register 49, reporting 47
in register, not reporting: BHA-L07, BHA-L19, BHA-L33, BHA-S04
reporting, not in register: BHA-L46, DESKTOP-7F2K
22.2 Reading the result
The register lists 49 devices; 47 report. Four registered devices are not reporting: laptops L07, L19, L33 and server S04. Two reporting devices are not registered: L46 and DESKTOP-7F2K.
The two totals differ by only two devices, but the lab finds six mismatches in total. The gap between 49 and 47 hides this detail, which is why Aisha prints both differences instead of the totals alone. Aisha reruns the lab and confirms the same six names appear, so the result does not depend on the order of the export.
22.3 Investigating
L07 is in a drawer; L19 and L33 have broken agents; S04 was never enrolled. L46 is a new laptop not yet registered; DESKTOP-7F2K is a volunteer's personal PC that joined with old credentials.
The six findings fall into a small number of distinct types of cause. Two are broken agents, which is a management fault; one, S04, was never enrolled, which is an onboarding gap; one, L07, is a laptop out of use. Of the two unregistered devices, L46 shows a gap in purchasing records, and DESKTOP-7F2K shows a weakness in the enrolment process.
22.4 Fixing
Agents are repaired, S04 is enrolled, L46 registered and the personal PC removed and its access revoked.
After the fixes, the comparison is rerun and the only remaining difference is L07, now recorded as a spare. The volunteer's personal PC loses its access, and the enrolment code it used is rotated so only IT can enrol devices. Gareth records each fix in the change log with the date and asset tag. The weekly comparison now emails Gareth any difference, so a new mismatch appears within a week instead of at the next audit.
Keeping the inventory current
After fixes, Aisha automates the comparison to run weekly, sending Gareth a short email listing any differences. Joiners' laptops are added to the register when ordered, and leavers' laptops are marked when returned. Within a month, the weekly comparison shows no unexplained differences.
Resolving the differences
Missing devices L07, L19, L33 and S04 are traced: L07 was in a drawer awaiting repair, L19 and L33 had broken agents, and S04 is the unenrolled application server. The extra entries L46 and DESKTOP-7F2K are a new laptop not yet registered and a volunteer's personal PC that joined with an old enrolment code.
Worked example
Gareth asks how the personal PC joined. The volunteer used an old enrolment code; Gareth rotates it and limits enrolment to IT.
Synthetic case. Synthetic.
Errors and limits
Inventory differences need investigation, not just counting.
Exercises
- EX064 — Lab counts. How many registered devices were not reporting, and which? Rubric: 3 = 4: L07, L19, L33, S04; 2 = two; 1 = one; 0 = none.
- EX065 — Unregistered. Which devices reported but were not registered? Rubric: 3 = L46, DESKTOP-7F2K; 2 = partial; 1 = vague; 0 = none.
- EX066 — Personal PC. How was the personal PC handled? Rubric: 3 = removed, access revoked, enrolment code rotated; 2 = partial; 1 = vague; 0 = none.
Synthesis
Reconcile inventories to make every control reach every device.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →