Asset management is the least popular topic in security and the one that decides whether anything else works. Patching assumes a list. Monitoring assumes a list. Incident response assumes a list. Vulnerability scanning assumes a list.
It is CIS Control 1 for exactly that reason, and almost no organization has a complete one.
Why It Is So Hard
Assets arrive from too many directions. Procurement buys laptops. A developer spins up cloud instances with a company card. A team signs up for a SaaS product. An acquisition brings an entire second environment. Contractors bring their own machines. Someone plugs in a device nobody approved.
Nothing removes assets either. Servers get decommissioned in spirit and left running. Cloud resources outlive the project. Test environments become permanent.
So the inventory is never finished. The goal is not perfection, it is a list that is accurate enough, updated often enough, to make decisions with.
Building It From Imperfect Sources
No single source is complete, and reconciling several is the actual method.
Network discovery and scanning finds things that respond on the network. Endpoint management and EDR consoles list managed machines. Cloud provider APIs enumerate cloud resources accurately, which is one place where the data is genuinely good.
Your identity provider lists applications people sign into. DHCP and DNS records show what has been on the network. Procurement and finance records catch anything being paid for. And NAC profiling is one of the best sources for the unmanaged devices, printers, cameras, and building systems that nothing else sees.
The differences between these sources are the finding. A device in EDR but not in procurement, or in the cloud console but in nobody's budget, is exactly what you are looking for.
What to Record
Identity of the thing, meaning hostname, addresses, serial or resource identifier.
An owner, both a technical owner who can log in and a business owner who cares whether it runs. This field is the one most often left blank and the one most needed during an incident.
What it does, and how important that is. Criticality drives everything downstream, from patching priority to recovery order.
What data it holds or touches, which drives compliance scope.
Environment, lifecycle state, and support status. And network exposure, because internet facing changes every risk calculation.
Keeping It Accurate
Automate collection wherever possible. A manual inventory is accurate on the day it was compiled and decays from there.
Reconcile sources on a schedule and treat discrepancies as work rather than noise.
Tie the inventory into the processes that create and destroy assets: procurement, provisioning, and decommissioning. If a new cloud resource does not appear automatically, the list will always trail reality.
Require an owner. Assets with no owner should be an exception that someone has to resolve, not a permanent category.
External Attack Surface Management
A useful adjacent discipline: looking at your organization from the outside to find what is exposed, including things you did not know were yours. Forgotten subdomains, a marketing site someone stood up years ago, a development environment left public.
Tools in this space include Tenable, Palo Alto Cortex Xpanse, and runZero. Free reconnaissance techniques cover a surprising amount of the same ground, which is what Module 2 of the CEH course teaches.
Software Inventory Too
CIS Control 2 is software, and it is a separate problem. You need to know what is installed, what version, and increasingly what components are inside your own applications.
That last part is the software bill of materials, and it is what lets you answer the question that arrives on a bad morning: are we affected by this newly announced vulnerability in a widely used library. Organizations with a bill of materials answer in minutes. Organizations without one spend a week guessing.
Start Small and Real
Do not attempt a perfect configuration management database. Those projects are famous for consuming years.
Start with the assets that matter most: internet facing systems, systems holding regulated data, and systems that stop the business if they stop. Get those right, with owners.
Then widen. An accurate list of the fifty things that matter beats an inaccurate list of five thousand.
Learn This at HackRange
Week 3 and Week 6 of the mentorship both drive at this. You cannot audit a server you did not know existed, and you cannot patch it either.