Background and Challenges

• Lack of Clarity: Traditional asset discovery often relies on manual organization or network management software. Using specialized protocols or agents for discovery requires that target assets be compatible with these tools, limiting the types and quantities of discoverable assets. Conversely, relying on manual inventory can result in coarse-grained asset information, leading to gaps in records. This results in an unclear picture of asset statuses within a jurisdiction, including specific asset lists, the number and types of active assets, the quantity of unauthorized systems, and whether any systems remain overdue for decommissioning. Consequently, daily network security risk monitoring may overlook certain threats, leaving vulnerabilities unaddressed.
• Integration Challenges: Single-source asset data has limitations and may not comprehensively cover all assets, resulting in incomplete asset inventories and potentially inaccurate or outdated information. Additionally, relying on a singular vulnerability source may lead to missed new vulnerabilities due to outdated databases and limited coverage, resulting in false positives and negatives without sufficient contextual information to support comprehensive risk assessments. Furthermore, having multiple sources for asset and vulnerability data often complicates management due to discrepancies in data fields.
• Lack of Focus: Exposed assets are a primary source of security incidents, often harboring high-risk vulnerabilities and weak passwords that severely impact organizational security and reputation. Assets continually evolve with business upgrades, making it challenging to identify which are high-risk and susceptible to exploitation. For instance, pinpointing critical high-risk assets based on value and business reliance is difficult, as is determining which assets are prominent attack targets with numerous or severe vulnerabilities based on vulnerability scans and threat intelligence. This lack of focus in security measures can lead to overlooked high-risk assets, increasing the likelihood of attacks and significant consequences.

Core Capabilities and Advantages

Multi-source Heterogeneous Data Collection and Fusion:

• Data Collection: The solution supports proactive asset mapping and passive traffic monitoring to gather network asset information, including but not limited to IP addresses, access locations, website names, technical frameworks, and versions. It also integrates with systems such as endpoint security management, server security management, HIDS, bastion hosts, and CMDBs to obtain asset information. Additionally, it connects with mainstream vulnerability scanning and management systems to gather asset security risk information.
• Data Fusion: Utilizing an open and scalable architecture, the solution employs normalization and recommendation algorithms. The normalization algorithm standardizes diverse asset data sources and formats to comply with uniform specifications, while the recommendation algorithm effectively resolves multi-source data conflicts.

Comprehensive Asset Security Profiling: The asset profiling design references international best practices, retaining historical values and metadata related to asset attributes, data sources, and collection methods. This allows for modeling network assets, including devices, software, components, and services. By overlaying asset attribute information across spatial and temporal dimensions, historical changes to each asset can be recorded and analyzed, creating a dynamic asset inventory based on time and network space.

Attack Surface Assessment Based on Vulnerability Intelligence: To enhance vulnerability remediation effectiveness, the system integrates with 盛邦's vulnerability intelligence. This partnership produces incremental, layered vulnerability patch intelligence, facilitating ongoing asset vulnerability collision analysis. When vulnerability intelligence or asset information updates occur, asset vulnerability collision analysis is triggered, identifying asset security risks by correlating CPE information with asset software names, versions, and components.

Open Asset Security Operation Framework: In response to customized security operation needs, the solution provides an asset security operation workflow framework and templates, pre-configured to support workflow and process automation. The workflow engine defines operational processes and forms, enabling seamless data flow between human interfaces and nodes. This transforms fragmented offline operations into standardized online processes, making operations monitorable, reusable, and measurable. Furthermore, it supports API integrations with external systems (e.g., OA, ticketing, SIEM, SOAR) to initiate processes or enable coordinated responses, facilitating closed-loop management of asset security operations without altering user habits, thus leveraging existing resources.

Key Benefits

• Comprehensive Asset Visibility: Firstly, the solution provides complete insights into assets, presenting the total quantity and specific composition clearly, eliminating management blind spots. Secondly, it enables timely detection of non-compliant components, extinguishing potential risks at their inception. Finally, from a management perspective, clarifying responsibilities through associated management information streamlines the asset management process, assigning accountability at every stage and enhancing overall efficiency and security.
• Precise Asset Posture Analysis: Customers can connect with vulnerability intelligence to promptly identify at-risk assets and preemptively mitigate risks. Establishing relationships among assets aids in tracing asset interdependencies, allowing for precise assessments of risk impact. This understanding helps customers formulate targeted response strategies. Integrating security capabilities strengthens the overall security framework, effectively countering external threats.
• Reduction of Attack Surface: By leveraging asset and vulnerability data, security teams can make more informed, precise decisions regarding asset security management. Automated response capabilities offer efficient risk mitigation options, saving time and labor costs. Identifying potential attack vectors allows customers to understand risk propagation pathways, enhancing prevention and containment efforts, and continuously refining security measures to diminish security vulnerabilities.