Cisco recently published vulnerability details which affect their 7800 and 8800 series of IP (VoIP) phones. These phones are sold across many different model numbers and can be found in businesses and organizations of varying sizes. Originally reported to Cisco by Qian Chen of the Codesafe Team of Legendsec at QI-ANXIN Group, this vulnerability does not require authentication for successful exploitation and can provide attackers remote code execution and/or denial-of-service (DoS) capabilities.

What is the impact?

Cisco assigned a CVSS “high” rating to this vulnerability (tracked as CVE-2022-20968) and has acknowledged that proof-of-concept exploitation code exists. Firmware for all 7800 and 8800 series IP phones (with the lone exception of Cisco Wireless IP Phone 8821) contains this vulnerability, which resides in the input validation logic of received Cisco Discovery Protocol packets. Attackers who have presence in the same VLAN or network segment as vulnerable devices can send specially-crafted Cisco Discovery Protocol packets to trigger a stack overflow, resulting in a denial-of-service condition or potential code execution.

Are updates available?

All firmware versions (14.2 and prior) for these 7800 and 8800 series IP phones contain this vulnerability (CVE-2022-20968), and Cisco is not planning on releasing patched firmware –which is currently expected to be version 14.2(1)– until next month (January 2023).

In the meantime, Cisco does offer the following mitigation for vulnerable IP phones:

Administrators may disable Cisco Discovery Protocol on affected IP Phone 7800 and 8800 Series devices. Devices will then use LLDP for discovery of configuration data such as voice VLAN, power negotiation, and so on. This is not a trivial change and will require diligence on behalf of the enterprise to evaluate any potential impact to devices as well as the best approach to deploy this change in their enterprise.

You can find the full details around this mitigation in the associated Cisco Security Advisory (see “Workarounds” section).

How do I find potentially vulnerable Cisco 7800 and 8800 series IP phone assets with runZero?

From the Asset Inventory, use the following pre-built query to locate Cisco 7800 and 8800 series IP phone assets which may need remediation:

type:"IP Phone" and (hw:"Cisco CP-78" or hw:"Cisco CP-88")

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.

Earlier this week, researchers with Eclypsium shared findings on three vulnerabilities present in American Megatrends (AMI) MegaRAC firmware. MegaRAC can be found in many server manufacturers’ Baseboard Management Controllers (BMCs), including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan. Successful exploitation of these vulnerabilities can provide an attacker with remote code execution, an administrative shell, and user enumeration. Given American Megatrend’s broad reach across server manufacturers and models the number of systems with vulnerable MegaRAC BMC firmware could be quite large.

What is the impact?

These vulnerabilities are scored as CVSS “critical” and “high” severities, and the reported vulnerability details include:

• CVE-2022-40259 (CVSS “critical” score of 9.9) – Remote code execution via Redfish API; requires initial access to an account with callback privileges or higher
• CVE-2022-40242 (CVSS “high” score of 8.3) – Administrative shell via default credentials
• CVE-2022-2827 (CVSS “high” score of 7.5) – User enumeration via API request manipulation

The Eclypsium report does mention that public exposure of vulnerable BMCs appears to be “relatively low compared to recent high-profile vulnerabilities in other infrastructure products.” That said, data centers where many similar servers exist -–including data centers providing cloud-based resources-– could yield many opportunities for an attacker who has attained access, and detection of BMC exploitation can be “complex” and is likely to be missed with traditional EDR/AV.

Are updates available?

While American Megatrends has not made a security advisory available at the time of this publication, owners and administrators of systems with MegaRAC BMC firmware should check with their server manufacturers for patched firmware updates.

Mitigations are offered in the Eclypsium report (see the “Mitigations” section), including (but not limited to) the following suggestions:

• Ensure that all remote server management interfaces (e.g. Redfish, IPMI) and BMC subsystems in their environments are on their dedicated management networks and are not exposed externally, and ensure internal BMC interface access is restricted to administrative users with ACLs or firewalls.
• Review vendor default configurations of device firmware to identify and disable built-in administrative accounts and/or use remote authentication where available.

How do I find potentially vulnerable MegaRAC BMC assets with runZero?

From the Asset Inventory, use the following pre-built query to locate BMC assets running MegaRAC firmware which may need remediation:

type:"BMC" and (hw:"MegaRAC" or os:"MegaRAC")

You can also locate all BMC assets in your environment by searching your Asset inventory for type:"BMC", which can then be triaged further.

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.

On October 3, 2022, the Cybersecurity and Infrastructure Security Agency (CISA) released the Binding Operational Directive (BOD) 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks. This directive requires all Federal Civilian Executive Branch (FCEB) departments and agencies to comply with a set of cybersecurity requirements by April 3, 2023. Under the directive, asset visibility and vulnerability detection capabilities must be improved to meet the requirements outlined by CISA.

The BOD 23-01 strives to improve visibility and vulnerability detection on federal networks. However, the issues addressed by this directive are not exclusive to federal agencies. Asset inventory and vulnerability management are encouraged as best practices for all organizations, even though only FCEB agencies are legally required to comply by the April 3, 2023 deadline. In fact, CISA Director Jen Easterly told reporters, “Knowing what’s on your network is the first step for any organization to reduce risks.”

Asset visibility is foundational to cyber security

Cyber security is a universal challenge where asset inventory plays a major role. In other words, knowing your asset inventory is necessary for effective cyber security practices to be implemented. Easterly also said, “While this Directive applies to federal civilian agencies, we urge all organizations to adopt the guidance in the directive to gain a complete understanding of vulnerabilities that may exist on their network. We all have a role to play in building a more cyber resilient nation.” Regardless of whether or not an organization is a federal civilian agency, asset inventory should be the first step in reaching meaningful risk mitigation.

Modern cyber security practices require multi-part defensive measures. As technology has evolved, so have the threats to our security. More recently, the diversification of network environments in the civilian workplace has made network security and tracking more difficult. What had been a gradual transition to hybrid networks as the norm escalated rapidly during the pandemic, forcing security teams to suddenly manage on-premise, hybrid, and cloud networks more quickly than they were prepared to do. Network visibility now faces new challenges as networking environments have shifted.

There are too many assets to be tracked via manual methods, like spreadsheets. Not to mention unknown assets that may have been missed by traditional discovery methods. If you don’t know about an asset, how can you scan it for vulnerabilities?

Asset visibility is a critical building block for security measures, allowing you to have context around every asset connected to your network. You can leverage this data to assess endpoint detection and response (EDR) and vulnerability scan gaps in your network security. Thus ensuring you have strong, comprehensive network security coverage.

BOD 23-01 requires asset inventory and vulnerability enumeration

The number of assets has only continued to increase over time and CISA says “continuous and comprehensive asset visibility is a basic precondition for any organization to effectively manage cybersecurity risk.” In a 2021 US Senate report, federal agencies highlighted common asset and vulnerability challenges regarding their cyber security posture. That’s where CISA BOD 23-01 comes into play.

BOD 23-01 focuses specifically on asset discovery and vulnerability enumeration which, as indicated in the diagram above, are critical pieces of any cyber security program. By April 3, 2023, federal civilian agencies need to have taken steps to comply with the following requirements:

• Perform automated asset discovery every 7 days, covering a minimum of the organization’s IPv4 space.
• Ingest on-demand vulnerability scan reports within 72 hours of a CISA request and be able to present findings to CISA within 7 days.
• Perform vulnerability enumerations every 14 days with detection signatures that are no more than 24 hours old.

This criteria demands automated, on-demand, and rapid asset discovery capabilities. For many organizations, the volume of assets is too large for manual processing. BOD 23-01 aims to ensure federal agencies can keep up with their asset visibility and tracking. Automation must be able to report vulnerability data into a CDM dashboard to comply with BOD 23-01. CISA BOD 23-01 implementation guidelines specify what assets types fall within the scope of this directive, such as bring-your-own-device (BYOD) assets, communication devices, and more.

Asset discovery and vulnerability enumeration

The CISA BOD 23-01 requires that asset discovery capabilities must be able to capture high-fidelity data for managed and unmanaged devices. This data must be readily available, and presented in a digestible format to be considered compliant with the new directive. But asset discovery is only half the battle. There are several agencies that use vulnerability scanners to conduct discovery in addition to the traditional use of conducting vulnerability assessments. Vulnerability scanners are not an effective way to meet the new CISA requirements for asset inventory because they have limitations in terms of when they can run and how long the scans can take. FCEB agencies, and other organizations are encouraged, need a discovery solution that enables same-day response.

Asset discovery and vulnerability enumeration are the focal points of BOD 23-01. These two aspects of cyber security empower organizations to “better account” for assets and risks that have previously been unknown, and therefore unprotected, within their networks. While the CISA BOD 23-01 aspires to discover and protect the critical infrastructure and networks of the government, the same values can be applied to networks at large, no matter how the network is structured.

Asset discovery is a foundational security measure

The BOD 23-01 states, “Asset visibility is the building block for operational visibility.” Organizations must be able to identify IP addresses directly in the network as well as associated IP addresses. BYOD, cloud, and other assets are included in this identification requirement. IPv4 addresses need to be accounted for in their entirety at a minimum, though full visibility of other IP addressable assets are highly encouraged.

There are several ways to perform asset discovery, including active, passive, and external scanning. Each method will bring certain assets to light, but these methods also come with their own challenges.

• Active: An active scan transmits network packets or queries local hosts and then analyzes responses. In other words, active scanning creates traffic for the network. If you are scanning a network with fragile devices, ensure that you pick a scanner that has been designed to safely scan these devices.
• Passive: These scans observe traffic that traverses the network adapter the scanner is configured to listen in on. Passive scanning collects data about the assets actively talking on a limited section of the network, limiting visibility to a singular “choke point” and active assets. Passive collection is difficult to deploy across a sprawling organization. Encrypted protocols have made passive asset inventory increasingly harder.
• External: External attack surface management (EASM) tools provide a perimeter view of IP addresses outside your network. Scanning external attack surfaces helps with gaining visibility to external hosts or exposed services, reconnaissance in penetration testing, and more. However, network owners can opt to hide their IP ranges, preventing those assets from showing up on your scan. Additionally, these are conducted without direct access to the network so visibility may be limited even further.

Effective asset discovery capabilities will deliver visibility into both internally and externally facing assets. As a result, you’ll have a more comprehensive asset inventory, allowing you to quickly identify and track when assets come online or go offline.

Critical vulnerabilities must be enumerated within 72 hours

Cyber security programs must be able to identify asset-specific vulnerabilities on-demand to comply with BOD 23-01 requirements. This applies to any information technology or operational technology asset that is accessible via IPv4 or IPv6 networks. BOD 23-01 mandates that agencies enumerate vulnerabilities across all discovered assets, such as operating systems, software and versions, potential misconfigurations, and missing updates. However, vulnerability enumeration has its own challenges and limitations with fingerprinting.

On top of struggling to meet data requirements, vulnerability management solutions lack the ability to meet the requirements outlined in CISA BOD 23-01, particularly, the 72 hour response timeline. Vulnerability scan times can vary greatly, depending on the business restrictions in place. Oftentimes, teams need to wait until the new vulnerability checks are available in order to scan for the newest security flaw. The solutions then need to scan the network again, which often requires waiting for the next maintenance window. This makes the required 72 hour response time extremely challenging to meet.

A modern approach to identifying potentially vulnerable systems much faster is to decouple the network scan from the vulnerability analysis. A modern asset discovery solution will be able to scan the hardware and software assets on the network with enough detail that it already contains enough information to identify potentially vulnerable systems. As a result, security teams can identify potentially impacted systems in minutes by querying the database. This approach is much faster than the traditional path of waiting for updated vulnerability checks, updating the scanners, scanning the network, and running reports on the new vulnerability.

Reducing the network security threat surface through asset inventory and vulnerability management solutions is critical to one’s overall security posture. One tool without the other is not enough to comply with the recent directive. Asset inventory and vulnerability management solutions work together to provide a clearer picture of an organization’s security posture.

How runZero helps comply with BOD 23-01

runZero is a comprehensive asset inventory solution that uses active, unauthenticated scanning capabilities as well as the ability to pull in third-party data, for example from vulnerability scanners, for a full picture of your network. runZero was founded by HD Moore, the creator of Metasploit, with cyber security fundamentals in mind. The runZero scan engine was designed from scratch to safely scan fragile devices.

runZero can help with administering asset discovery and inventory management in several ways including:

• Discover the entire IPv4 space in less than 7 days: BOD 23-01 requires that the entire RFC 1918 space is scanned every 7 days for asset inventory. Most scanning technologies, especially vulnerability scanners, will struggle to cover an entire agency in this amount of time. runZero can cover the entire internally addressable RFC 1918 space overnight. runZero can also scan the agency’s external perimeter.
• No credentials required: BOD 23-01 states that “asset discovery is non-intrusive and usually does not require special logical access privileges.” runZero features a proprietary unauthenticated active scanner that was designed with asset inventory in mind. Many other solutions require credentials to obtain enough information about systems
• Respond rapidly to imminent threats: BOD 23-01 requires agencies to “develop and maintain the operational capability to initiate on-demand asset discovery and vulnerability enumeration to identify specific assets or subsets of vulnerabilities within 72 hours of receiving a request from CISA and provide the available results to CISA within 7 days of request.” After a new vulnerability story breaks, vulnerability scanners often take 1-2 weeks to create a vulnerability check for new vulnerabilities before agencies can even start testing. In most cases, you can use runZero’ existing scan data to find affected systems in a matter of seconds without having to rescan.
• Get asset context on enumerated vulnerabilities: runZero integrates with Tenable, Rapid7 and Qualys to import vulnerability data into the asset inventory to provide contextual information on what assets a vulnerability was found on as well as the network context of the asset. In addition, runZero makes it easy to check that your vulnerability scanners are covering all of your subnets, highlighting any security control coverage gaps.
• Import asset inventory data to the CMDB or Agency Data Lake: According to the CISA CDM architecture diagram, active scanners should push their data into the CMDB, which publishes data to the agency data lake that feeds the CDM. runZero integrates with CMDBs (e.g. ServiceNow). Some agencies that do not have an existing CMDB may even choose to aggregate data in runZero directly and feed the Agency Data Lake from there. runZero integrates with vulnerability scanners, endpoint detection and response (EDR) solutions, mobile device management (MDM) software, Microsoft Active Directory / Azure AD, attack surface management vendors, and cloud hosting providers to aggregate and consolidate all asset data in a single platform. It then offers a simple JSON export API to pull the asset inventory into a data lake.

Discover internal and external assets

runZero discovers internal and external assets, providing the high-fidelity context needed to fulfill BOD 23-01 requirements. Set up recurring unauthenticated scans to keep your asset inventory awareness up. Alerts for new asset connections or existing asset changes can be easily added to your scans. You can also conduct on-demand scans as needed and get the asset contextualization you need in minutes, complete with downloadable, digestible reports that you can present to your team (or CISA).

To meet the requirements outlined in BOD 23-01, your asset discovery solution needs to be able to quickly capture high-fidelity asset data on everything within your firewall as well as exposed services to properly assess your asset vulnerabilities. runZero can give you a strong picture of your external attack surface. Through active scanning and integrations, runZero augments data found by taking inputs from internal IPs that have been discovered and identifying public-facing hosts. Additionally, our unauthenticated scans can discover assets on a network without requiring a username/password. This approach is unobtrusive, because it doesn’t require credentials and agent deployment is time consuming and only covers managed assets.

Build a comprehensive asset inventory

A complete asset inventory includes unmanaged devices, internal and external assets, and having relevant data available on all of these assets. This level of visibility is essential both for strengthening your security posture and for meeting BOD 23-01 requirements. Unauthenticated scanning is the best way to quickly capture this information without having to worry about system fragility or resource-intensive setup like with agent-based solutions.

runZero creates a comprehensive picture of your asset inventory through on-demand unauthenticated scans and integrations, giving you more accurate fingerprinting of your assets, including those you don’t know about. You can find unmanaged devices and see when assets come on or offline in your network. Additionally, runZero gives you full control of your scans and queries, including the ability to create custom queries, generating alerts for specific assets in your scan results.

Enrich assets with vulnerability data

runZero leverages asset data from multiple sources, as well as its own unauthenticated scanner, to deliver full visibility into assets across any environment. Integrations with vulnerability scanners, like Tenable, Qualys, and Rapid7, will help you:

• Add additional asset context to your vulnerability data
• Find gaps in your vulnerability scan coverage
• Respond to emerging vulnerabilities faster

Search web screenshots for oddities, identify outliers, and see assets that may need to be patched with on-demand custom queries. For example, let’s assume developers were aware of Log4Shell on the first day. They weren’t able to immediately go into their systems to find and fix the vulnerability because no one had checks available on day one. As a result, teams typically had to wait for their vuln scanner to have the checks available and then wait for a maintenance window to scan their targets resulting in delays in their ability to assess and remediate issues.

During one of our case studies, a customer that had been using ServiceNow ITOM (IT Operation Management) realized they struggled with getting all of the asset data they needed. This was especially true for their unmanaged assets, but they didn’t have the desired data for their managed assets either. The customer said, “The team looked at Qualys as an alternative data source for ServiceNow Discovery, but the system (scanned through appliances) was too slow.”

Log4Shell highlighted the importance of having the ability to quickly search an existing inventory to find assets that may be impacted by a new vulnerability without having to run a new vulnerability scan. runZero was able to provide prebuilt queries to help customers find potentially affected assets before vulnerability scanners had checks available for products and services using the Log4J.

runZero exceeds the asset visibility requirements of BOD 23-01

CISA BOD 23-01 was created to strengthen the overall cyber security posture of federal civilian agencies by requiring improvements around asset inventory and vulnerability management. With several tools and methods being used to conduct these practices, the new timeline requirements will force agencies to evaluate existing processes to comply with BOD 23-01 runZero will unify and enrich asset data from your existing security tools to deliver visibility across your internally and externally facing assets. You can take runZero for a test run with our free 21-day Enterprise trial or get a demo to learn how runZero can help your business. Contact us if you’d like to test our self-hosted version.

What’s new with runZero 3.3?

• Extended visibility into Google Workspace
• Queries for Google Workspace users and groups
• Fingerprinting for Google assets
• Identification of OpenSSL services
• Improvements to the runZero Console

Extended visibility into Google Workspace

runZero 3.3 furthers the visibility into your Google ecosystem through a new integration with Google Workspace. runZero Professional+ users will be able to sync Google Workspace asset details from mobile devices, endpoints, and managed Chrome systems, while runZero Enterprise users will also be able to sync Users and Groups. Once the integrations are configured, users can view, search, analyze, export, and alert on attributes from both Google Workspace and Google Cloud Platform.

One of the key reasons to leverage the runZero integrations is to get better insight into the scope of your environment and completeness of coverage since MDM and IAM platforms can’t provide any insights into devices that haven’t been onboarded. To identify assets on your network that aren’t onboarded to Google Workspace, use the query source:runZero AND NOT source:googleworkspace. Conversely, use this query to find assets from Google Cloud Platform or Google Workspace that have not been scanned by runZero yet: (source:gcp OR source:googleworkspace) AND NOT source:runzero. These queries can help you keep pace with unmanaged and disconnected assets.

The integration also pulls in many Google Workspace attributes to give you comprehensive asset visibility. This could include attributes like when a device was last synced, whether a device has a password enabled or is encrypted, or whether it supports the use of a work profile. The Recent Users list in the asset details can also provide insight into device ownership and usage. You can filter for a specific user by using the @googleworkspace.mobile.email attribute for mobile devices or the @googleworkspace.chromeos.recentUsers attribute for ChromeOS devices. To find mobile devices that aren’t locked with a password try the query @googleworkspace.mobile.devicePasswordStatus:="Off", or use @googleworkspace.mobile.encryptionStatus:="Not Encrypted" to find ones without encryption enabled. The wildcard operator also lets you find results with a range of OS versions, such as using @googleworkspace.endpoint.osVersion:="MacOS 12.% to find Google Workspace assets running macOS Monterey.

runZero offers unmatched active network scanning, while also integrating with an ever-growing list of data sources so that you have a complete asset inventory at your fingertips. To get started, set up a connection to Google Workspace or Google Cloud Platform.

Queries for Google Workspace users and groups

runZero Enterprise users can leverage the new queries tailored for the Google Workspace integration to quickly find and alert on accounts that match particular parameters, in addition to being able to run searches in the Users and Groups inventories. Identify administrator accounts, suspended accounts, and accounts without MFA to improve IAM efforts and better protect your environment. These queries are included in the Query Library and can also be used to create alerts.

Run queries about Google Workspace users or create an alert rule to find assets of interest.

Fingerprinting for Google assets

runZero includes fingerprints for the metadata returned by the Google integrations, including Google Cloud Platform and Google Workspace. This will help provide the most accurate operating system and hardware data about the assets in your inventory.

In addition to Google fingerprints, runZero has also improved fingerprinting coverage of Microsoft 365 Defender assets and SNMP devices. Additional support was added or improved for products by Apache, Aruba, Avaya, Axon, Cisco, CyberPower, Debian, Eaton, Epson, Fortinet, Fujifilm, Geist, Hikvision, Lexmark, Oracle, Sato, Sony, Vivi, and VMware.

Identification of OpenSSL services

In preparation for the OpenSSL vulnerability announcement, runZero released remote, unauthenticated fingerprinting for OpenSSL 3 services, allowing our users to get ahead of the mitigation process prior to the vulnerability details becoming public. This capability has since expanded to detect even more TLS implementations and track the TLS stacks in use on each asset. runZero users can find OpenSSL endpoints using the query product:openssl, in the assets, services, and software inventories.

The server-side exposure only applies to services that process client certificates. runZero already performs checks for this, even though it is not a common configuration. To identify services running OpenSSL 3.0.x variants that may be vulnerable to exploitation, use the following query in the service inventory search: _service.product:"OpenSSL:OpenSSL:3" AND tls.requiresClientCertificate:"true".

Improvements to the runZero Console

The 3.3 release includes several changes to the user interface to improve the performance of the runZero console. The tables on the Explorers, Sites, Organizations, and Your team pages now perform and load faster. This will let users query and sort the results in tables more efficiently, getting to the answers they need faster.

The release also extends the availability of the All Organizations view. All users now have a view that will show them the results from all of the organizations that they have access to. The available permissions in that view reflect their per-organization permissions so that they can manage resources just like they would when viewing a single organization.

Release notes

The runZero 3.3 release includes a rollup of all the 3.2.x updates, which includes all of the following features, improvements, and updates.

New features

• runZero Professional and Enterprise customers can now sync assets from Google Workspace.
• runZero Enterprise customers can now sync users and groups from Google Workspace.
• The “All Organizations” view is now available to restricted users with a filtered scope.
• User interface tables were revamped for Organizations, Sites, Explorers, and Teams.
• Live validation is no longer required for Qualys VMDR and InsightVM credentials.
• Fingerprint updates.

Product improvements

• The subnet utilization report now supports filtering by site.
• CSV export of assets now includes the same hostname information as the inventory view.
• Up-to-date ARM64 builds of the standalone scanner are now available.
• The account API endpoint for creating organizations now accepts the argument types documented.
• Merging two assets now correctly updates the date of the newest MAC address for the resulting asset.
• Disabling all scan probes now disables the SNMP probe.
• Service Provider information is now displayed with a default domain before SSO settings are configured.
• Explorers are now ordered alphabetically on the scan configuration and connector configuration pages.
• runZero users logging in via SSO are now presented with the terms and conditions acceptance dialogue.
• A new tls.stack attribute that tracks the TLS software provider and version has been added for assets and services.
• A new canned query for OpenSSL 3.0.x with client certificate authentication has been added.
• The scanner now reports OpenSSL versions via TLS fingerprinting.
• The scanner now reports Tanium agent instances on the network.
• The scanner now reports additional detail for SSLv3 services.
• The search keywords has_os_eol and has_os_eol_extended are now supported on the Assets and Vulnerabilities inventory pages.
• The “last seen” link to the most recent scan details has been restored on the asset details page.

Performance improvements

• Improved performance when scanning from macOS hosts that have certain EDR solutions installed.
• Improved performance of Intune integration when importing a large number of users and devices.
• Scan task processing speed has been improved for SaaS and self-hosted customers.
• The baseline memory usage of Explorers has been reduced.
• Error handling of misconfigured fingerprints has been improved to reduce Explorer and scanner crashes.

Fingerprinting changes

• Improved fingerprinting coverage of Microsoft 365 Defender for Endpoints assets.
• Improved fingerprinting coverage of SNMP devices.
• Tanium agent detection now sets the edr.name attribute.
• Added fingerprinting of OpenSSL, GnuTLS, and Windows TLS stacks, including version when possible.
• Apple ecosystem OS fingerprint updates.
• Additional support added-or-improved for products by Apache, Aruba, Avaya, Axon, Cisco, CyberPower, Debian, Eaton, Epson, Fortinet, Fujifilm, Geist, Hikvision, Lexmark, Oracle, Sato, Sony, Vivi, and VMware.

Integration improvements

• The AWS integration now includes an option to delete AWS-only assets that were not seen in the most recent import.
• The Qualys integration now includes an option to import unscanned assets and is disabled by default.
• Processing speed for large Qualys imports has been improved.
• GCP credentials can now be configured to import assets from multiple projects.
• The error message indicating that an AWS integration credential has insufficient permissions has been improved.

Bug fixes

• A bug that could prevent the use of third-party credentials when using TLS thumbprints or the insecure connection option with a public URL has been resolved.
• A bug which sometimes prevented GCP imports from completing has been fixed.
• A bug in how Service Inventory searches were launched from the Asset details page had been resolved.
• A bug that could prevent TLS probes from completing has been resolved.
• A bug that could prevent updating site metrics has been resolved.
• A bug that could prevent the Intune integration from completing long-running tasks has been resolved.
• A bug that could prevent the GCP integration from returning all assets has been resolved.
• A bug that could result in a recurring integration running again before the previous task finished has been resolved.
• A bug that could prevent importing assets from Microsoft Intune has been resolved.
• A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
• A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
• A bug that could cause broken asset links has been resolved.
• A bug that could cause missing service data for services with conflicting virtual hosts has been resolved.
• A bug that could cause inaccurate user counts for imported directory groups has been resolved.
• A bug that affected tooltip display has been resolved.
• A bug that prevented “open in new tab” navigation using middle/right click has been resolved.
• A bug that could prevent Azure AD imports has been resolved.

• Extended visibility into Google Workspace
• Queries for Google Workspace users and groups
• Fingerprinting for Google assets
• Identification of OpenSSL services
• Improvements to the runZero Console

• runZero Professional and Enterprise customers can now sync assets from Google Workspace.
• runZero Enterprise customers can now sync users and groups from Google Workspace.
• The “All Organizations” view is now available to restricted users with a filtered scope.
• User interface tables were revamped for Organizations,
• Sites, Explorers, and Teams.
• Live validation is no longer required for Qualys VMDR and InsightVM credentials. Fingerprint updates.

• The subnet utilization report now supports filtering by site.
• CSV export of assets now includes the same hostname information as the inventory view.
• Up-to-date ARM64 builds of the standalone scanner are now available.
• The account API endpoint for creating organizations now accepts the argument types documented.
• Merging two assets now correctly updates the date of the newest MAC address for the resulting asset.
• Disabling all scan probes now disables the SNMP probe. Service Provider information is now displayed with a default domain before SSO settings are configured.
• Explorers are now ordered alphabetically on the scan configuration and connector configuration pages.
• runZero users logging in via SSO are now presented with the terms and conditions acceptance dialogue.
• A new tls.stack attribute that tracks the TLS software provider and version has been added for assets and services.
• A new canned query for OpenSSL 3.0.x with client certificate authentication has been added.
• The scanner now reports OpenSSL versions via TLS fingerprinting. The scanner now reports Tanium agent instances on the network.
• The scanner now reports additional detail for SSLv3 services.
• The search keywords has_os_eol and has_os_eol_extended are now supported on the Assets and Vulnerabilities inventory pages.
• The “last seen” link to the most recent scan details has been restored on the asset details page.

• Improved performance when scanning from macOS hosts that have certain EDR solutions installed.
• Improved performance of Intune integration when importing a large number of users and devices.
• Scan task processing speed has been improved for SaaS and self-hosted customers.
• The baseline memory usage of Explorers has been reduced.
• Error handling of misconfigured fingerprints has been improved to reduce Explorer and scanner crashes.

• Improved fingerprinting coverage of Microsoft 365 Defender for Endpoints assets.
• Improved fingerprinting coverage of SNMP devices.
• Tanium agent detection now sets the edr.name attribute.
• Added fingerprinting of OpenSSL, GnuTLS, and Windows TLS stacks, including version when possible.
• Apple ecosystem OS fingerprint updates.
• Additional support added-or-improved for products by Apache, Aruba, Avaya, Axon, Cisco, CyberPower, Debian, Eaton, Epson, Fortinet, Fujifilm, Geist, Hikvision, Lexmark, Oracle, Sato, Sony, Vivi, and VMware.

• The AWS integration now includes an option to delete AWS-only assets that were not seen in the most recent import.
• The Qualys integration now includes an option to import unscanned assets and is disabled by default.
• Processing speed for large Qualys imports has been improved.
• GCP credentials can now be configured to import assets from multiple projects.
• The error message indicating that an AWS integration credential has insufficient permissions has been improved.

• A bug that could prevent the use of third-party credentials when using TLS thumbprints or the insecure connection option with a public URL has been resolved.
• A bug which sometimes prevented GCP imports from completing has been fixed.
• A bug in how Service Inventory searches were launched from the
• Asset details page had been resolved.
• A bug that could prevent TLS probes from completing has been resolved.
• A bug that could prevent updating site metrics has been resolved.
• A bug that could prevent the Intune integration from completing long-running tasks has been resolved.
• A bug that could prevent the GCP integration from returning all assets has been resolved.
• A bug that could result in a recurring integration running again before the previous task finished has been resolved.
• A bug that could prevent importing assets from Microsoft Intune has been resolved.
• A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
• A bug that could prevent importing assets from Microsoft 365 Defender has been resolved.
• A bug that could cause broken asset links has been resolved.
• A bug that could cause missing service data for services with conflicting virtual hosts has been resolved.
• A bug that could cause inaccurate user counts for imported directory groups has been resolved.
• A bug that affected tooltip display has been resolved.
• A bug that prevented “open in new tab” navigation using middle/right click has been resolved.
• A bug that could prevent Azure AD imports has been resolved.

Unmanaged devices are the Achilles heel of any asset inventory. Shadow IT, rogue, or orphaned devices are easy targets for the adversary to gain potential footholds onto the network.

The obvious question is: which discovery approaches are the most effective at finding unmanaged devices?

Why are unmanaged assets harder to find?

First, we need to examine why unmanaged devices are so difficult to find. Let’s break it down:

• Shadow IT devices: DevOps teams spin up machines but without central governance. Many discovery approaches need inputs to know where to look. So knowledge of these devices does not propagate to the rest of the organization.
• Rogue devices: As the name suggests, someone intended for these devices to remain under the radar and evade standard discovery techniques. Otherwise, they would only have remained rogue for a short time.
• Orphaned devices: Many discovery approaches require tuning or fresh inputs to keep the inventory current. Without caretakers to ensure the necessary calibration, orphaned devices become unmanaged assets that fall out of the asset inventory if they were ever there in the first place.

What has been tried and failed

So what are the traditional approaches to finding assets, and why do they fall short?

Endpoint agent (or just “agent”)

This approach requires installing software on every device which gathers excellent detail. This method only works with managed IT assets. After all, the device is known and probably managed if you can install software on it. So this approach does not address the bane of asset inventory–unmanaged assets.

Authenticated scans

This active scanning methodology uses one or more scanners to log into every device that responds within an IP range. Once logged in (typically via SSH or WMI), the scanner gathers excellent detail about the device. Similar to the previous method, the device is known and probably managed if you already know the credentials to get on it. So, once again, this approach only really works with managed IT assets.

Passive network monitor

This technique deploys one or more appliances on a network to eavesdrop on network traffic, including chatter from unmanaged assets. The setup requires sending network traffic to the appliance(s) by either reconfiguring one or more switches to span or inserting one or more taps into the network. Where in the network you make these changes matters. Eavesdropping at a network “choke point” is ideal since it ensures visibility into all traffic. For all the work involved, you, unfortunately, get little detail. Suppose an asset rarely talks on the network or is terse. In that case, there’s little data to work with, leading to imprecise or inaccurate fingerprinting. As more devices encrypt traffic, the fingerprinting accuracy gets worse.

API import

Solutions that generate asset inventories from API imports do not discover assets independently. They rely on the rest of the security and IT stack to cobble together an inventory. Completeness and accuracy depend on data quality from those sources. API import solutions will miss unmanaged assets and produce vague fingerprinting.

Unauthenticated scans

This final approach uses one or more scanners to actively scan for information from every device within an IP range. Unlike authenticated scans, these scanners do not attempt to log in to machines. Unauthenticated scans can discover unmanaged assets, even without prior knowledge. Since it’s an active scan rather than a passive monitor, it can interrogate the devices to gather much more information for accurate fingerprinting. The one shortcoming of this approach lies with sensitive devices. These assets tend to be older or low-powered, often found in operational technology (OT) environments, and may be disrupted by aggressive scanning.

New reasons for an old problem

So which approach works best for unmanaged assets? First, it’s worthwhile to understand how this state of asset inventory came to be. There was a time when security just needed to protect the corporate office. Over the past 20 years, the following trends started or magnified, leading to a divergence of environments. In some cases, these environments teem with unmanaged assets. Others permit the deployment of unmanaged assets. Still, others allow assets to become unmanaged more easily.

• More IoT devices: Network-enabled cameras and smart speakers are recent phenomena.
• Convergence of IT and OT: OT networks have been overlaid onto IP networks to improve manageability and, in many cases, come under the purview of IT.
• Move to the cloud: Many organizations see the cloud as a transformational journey to lower cost and increase speed & agility.
• Rise of DevOps: Software development and operations teams have adopted a methodology of shared ownership, automation-at-scale, and rapid feedback resulting in dynamic attack surfaces, particularly in the cloud. Unfortunately, there isn’t always governance in this area.
• More M&As: Each year in the 2010s, there were more than 2x the large M&As than each year in the 2000s.¹ When you take on a new company, you take on all its unknowns and risks too.
• Work from home: Pressures around talent shortage gave rise to a growing WFH trend that compounded due to the pandemic.

Against this backdrop of divergence of environments, there has been a convergence of responsibilities onto security teams. During this same time, organizations have improved their security posture around managed IT assets in on-prem environments. Assets outside this scope have become more attractive targets.

What works

Given these challenges, let’s look at the approaches that will work the most effectively.

Start with unauthenticated scans

Unauthenticated scanning is the only possible starting point–inherent limitations in the other four disqualify them as options. If only we could use an unauthenticated active scanning approach that avoids disrupting sensitive devices.

Mix in a security research-based approach

The missing ingredient is to couple a well-designed scanner with a security research-based approach. Such a recipe conducts discovery from the perspective of the adversary, someone who actively avoids disrupting devices and leaving digital footprints during recon. The scanner must use properly-formatted packets, which ensures the best chance of “good” behavior from a device and allows tuning of scan parameters, including overall and per-host scan rate. Just as important, the scanner must fingerprint as it scans, adapting the scan behavior as it learns asset details.

Zero unmanaged assets

This unauthenticated scan and security research-based approach has proven practicable in thousands upon thousands of real-world networks distributed over various environments: IT, IoT, OT, cloud, and remote. Start a runZero trial to see for yourself.

Get started with runZero in minutes

Do you know about the unmanaged assets on your network? Find them with runZero.

Get started