Asset Discovery Made Simple Using ORDR
Asset Inventory and Unparalleled Visibility Into Devices and Their Behaviors
You can’t protect what you can’t see.
Gaining visibility over an organization’s many devices is one of the most fundamentally important yet challenging tasks facing IT and security teams today. Without an accurate and up-to-date asset inventory, managing cybersecurity risks can be complicated. Yet, many IT and security teams struggle to answer the fundamental question of what devices are in their network.
This is because the number of connected endpoints has exploded both in terms of overall volume as well as diversity. In addition to traditional managed devices, IT teams must also corral a massive proliferation of unmanaged devices including IoT and OT, IoMT (Internet of Medical Technology), and employee BYOD (Bring Your Own Device). Further, these devices are constantly changing, with new devices being added or taken offline, and new ones being onboarded by different stakeholders within the organization.
There are specific questions to consider in an asset discovery solution:
- How complex is the process to discover all connected devices?
- Will your asset discovery solution accidentally disrupt the operations of sensitive devices?
- Can the solution answer the question of "what devices are connected" at a granular level?
- Can the solution answer the question of what exactly the devices are doing?
- Does it provide real-time and not a point-in-time approach to visibility?
- Does it continuously observe and monitor for anomalous and malicious behavior?
- Does it integrate with existing CMDB, CMMS or ITSM solutions?
Introducing ORDR Systems Control Engine (SCE)
This is where ORDR excels.
ORDR offers a unique differentiated platform for asset discovery. Using passive, agentless discovery, ORDR can automatically find and classify all connected devices whether managed or unmanaged. Each device is classified in granular detail including the make, operating system, serial number, application/port usage, location, and much more. This information can be shared with IT Services Management (ITSM), Configuration Management Database (CMDB) or Computerized Maintenance Management System (CMMS) as the single source of truth for all connected devices.
In addition to discovering and classifying devices, ORDR uses machine learning to profile and baseline device behavior. ORDR Flow Genome shows what systems devices are communicating with. These details can also be mapped via the ORDR Constellation Map for visual understanding of devices within network topologies such as VLANs and subnets.
With these insights, organizations not only have complete visibility into devices and what they are doing, but can also address critical security use cases:
- Identify devices running obsolete operating systems such as Windows 7
- Identify devices that are banned by the government
- Monitor devices with external Internet communications
- Monitor devices that are subject to compliance such as credit card readers, smart TVs and smart assistants
- Identify if high-value assets are in the wrong VLAN or in the same subnet as other vulnerable devices
Why ORDR Is Asset Discovery Made Simple
There are a number of reasons why ORDR is a superior asset discovery solution:
1. Agentless and Passive Scanning
Some IoT and unmanaged devices like medical devices or Industrial Control Systems (ICS) can be sensitive to active scans. ORDR employs various agentless and passive methods of data collection to identify and profile connected devices. There is no impact to any device or its operations in the network.
In addition, ORDR can also enrich insights from passive discovery with information from network infrastructure such as SNMP, IPAM, CMMS, Cisco Meraki etc. With proper deployment, ORDR can passively obtain a treasure trove of information to provide an accurate inventory of every device connected to the network.
2. Unified Visibility and Classification of Connected Devices
Much like a chess player needs to be able to see all the pieces on the board, IT and Security teams need to see all the devices on their network. Unfortunately, today that view is highly fractured with critical parts of the metaphorical chess board often being completely invisible.
ORDR brings all of an organization’s many connected devices into a single unified context, including managed and unmanaged devices. In one view, staff can see traditional managed devices like laptops and servers as well as unmanaged devices of all types, IoT, OT assets, medical devices, mobile and personal devices, and more. Visibility into this latter category of unmanaged devices is particularly important as it is the area of the greatest growth in most organizations.
ORDR also automatically classifies each device in granular detail. By combining Advanced Machine Learning with DPI (Deep Packet Inspection), ORDR passively reveals a wealth of critical context for every device. This includes:
Device Type and Function — Instead of merely seeing an IP address, teams can quickly distinguish between laptops, security cameras, HVAC systems, Building Automation Systems, or an infusion pump.
Device Details — Find critical information on each device including the specific device make, model, serial number, OS version, and more.
Network Context — See device network properties such as MAC/IP address, subnet, interface, VLAN, SSID, CDP/LLDP data, and other statistics.
Location — Devices can be identified in terms of their location in the organization.
3. Always-On, Continuous, Real-Time Asset Inventory
For many organizations, inventory management is performed as a periodic point in time audit. This can lead to considerable gaps in visibility when devices are missed or offline during an audit or if there are significant changes between scans. These gaps can mean organizations are often exposed for weeks or even months before the problem is identified.
ORDR ensures that asset inventory and management is a continuous process so that information is always up-to-date. Since all traffic is continuously analyzed, ORDR detects new devices and can inform security and IT teams, or device owners as soon as the device first connects. This real-time visibility allows staff to see a variety of devices that would typically be missed and left unmanaged including:
- Employee laptops and mobile devices that are often out of the office
- Devices owned by visiting partners or contractors
- Devices that were temporarily offline
- New employees or newly deployed devices
- Changes in device configuration or security posture between regularly scheduled scans
4. Monitoring Device Behavior
The ORDR Systems Control Engine monitors device behavior using machine learning and creates a conversation map, called a Flow Genome, of the communications pattern of every connected device. ORDR Flow Genome also learns the network topology — the VLANs, subnets, routing, and the access-layer connectivity graph of what is connected to each switch port and wireless AP. Security and networking teams can analyze this information and analyze communication mappings based on individual devices, groups of like devices, groups of devices based on business function, and even overlays based on the network topology. This can also be viewed via a constellation map featuring network topology details.
ORDR’s device behavior monitoring can help organizations with the following:
- Audit the communications of every device and see every other system it communicates to including IP address, web site/URL, and application protocols used
- View the communication patterns for all devices of the same type, such as Axis surveillance cameras, Rockwell PLCs, and Phillips patient monitoring systems to identify outliers
- Spot devices that communicate outside the organization, including traffic to "known bad sites" such as phishing, malware, and crypto-mining systems
- Reveal communication patterns of devices based on their business purpose, such as medical devices, manufacturing line equipment, and retail systems
5. Integration with ITSM, CMDB and CMMS
Having an asset inventory that is reliable and real-time is critical for security teams. But it can be challenging for traditional asset management solutions typically owned by IT to keep up with assets and devices outside their domain. ORDR integrates with ITSM, CMMS and CMDB solutions to enrich them with connected device insights. As shown in the diagram below, when integrated with ServiceNow CMDB, ORDR ensures that the latest granular insights on devices and their behavior is shared with ServiceNow.
Conclusion
There are many ways that organizations will benefit from having a complete asset inventory of their connected devices. Using ORDR, security teams will benefit from a unified view of all managed, unmanaged and IoT, IoMT or OT devices. Just as importantly, by monitoring the behavior of each device, organizations can ensure each device is behaving appropriately based on its unique role in the enterprise. And by integrating with an organization’s ITSM, CMMS or CMDB solutions, ORDR can help organizations get more value out of the solutions they have already invested in.