You can’t protect what you don’t know you have
Most security work starts with a list. A simple asset list you can make in a day.
When a new vulnerability comes out, the first question is “do we use that?”. Too many companies need a week to answer.
You don’t need an expensive tool. A spreadsheet works if someone keeps it up to date. Columns I use:
- What it is: server, laptop, firewall, cloud service, domain, SaaS app.
- Owner: one named person.
- Faces the internet? Yes or no. These get patched first.
- Software and version, for the important pieces.
- What data it holds.
- Who has admin access.
- Renewal dates: licence, domain, certificate.
Where to look so you don’t miss things: your DNS records, your cloud accounts, the firewall’s port list, the finance team’s list of subscriptions, and an outside scan of your public IPs. The surprises usually come from the subscriptions list.
Update it when something is added or removed, and review it every quarter. Then the next “do we use that?” takes five minutes.