Address Unauthorized Assets
Description
Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset.
Implementation Checklist
Tool Recommendations
Cyber asset attack surface management platform providing comprehensive asset inventory across IT, cloud, SaaS, and OT environments
Axonius · Enterprise subscription
Enterprise IT asset management and CMDB platform with automated discovery and lifecycle management
ServiceNow · Enterprise subscription
IT asset discovery and inventory platform scanning networks for hardware, software, and cloud assets
Lansweeper · Per-asset subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Rogue Device Network Infiltration
ConfidentialityAn attacker or insider connects an unauthorized device (e.g., rogue wireless AP, USB-tethered device) to the corporate network to intercept traffic or establish a backdoor.
Compromised IoT Device Persistence
IntegrityUnauthorized IoT devices with default credentials remain on the network indefinitely, providing persistent attack vectors that bypass endpoint security controls.
BYOD Malware Introduction
AvailabilityUnmanaged personal devices infected with malware connect to the enterprise network without quarantine or review, spreading infections to production systems.
Vulnerabilities (When Safeguard Absent)
No Process to Quarantine or Remove Unauthorized Assets
Without a defined process for addressing unauthorized assets, rogue devices persist on the network indefinitely with no accountability or remediation timeline.
Delayed Response to Network Intrusions
The absence of a weekly review cycle for unauthorized assets means malicious or non-compliant devices can operate undetected for extended periods.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |