Best practices for adding assets

Consider several things when selecting assets for a site. Asset selection can have an impact on the quality of scans and reports.

Choosing a grouping strategy for creating a site with manually selected assets

There are many ways to divide network assets into sites. The most obvious grouping principle is physical location. A company with assets in Philadelphia, Honolulu, Osaka, and Madrid could have four sites, one for each of these cities. Grouping assets in this manner makes sense, especially if each physical location has its own dedicated Scan Engine. Remember, each site is assigned to a specific Scan Engine.

With that in mind, you may find it practical simply to base site creation on Scan Engine placement. Scan engines are most effective when they are deployed in areas of separation and connection within your network. So, for example, you could create sites based on subnetworks.

Other useful grouping principles include common asset configurations or functions. You may want have separate sites for all of your workstations and your database servers. Or you may wish to group all your Windows 2008 Servers in one site and all your Debian machines in another. Similar assets are likely to have similar vulnerabilities, or they are likely to present identical logon challenges.

If you are performing scans to test assets for compliance with a particular standard or policy, such as Payment Card Industry (PCI) or Federal Desktop Core Configuration (FDCC), you may find it helpful to create a site of assets to be audited for compliance. This method focuses scanning resources on compliance efforts. It also makes it easier to track scan results for these assets and include them in reports and asset groups.

Being flexible with site membership

When selecting assets for sites, flexibility can be advantageous. You can include an asset in more than one site. For example, you may wish to run a monthly scan of all your Windows Vista workstations with the Microsoft hotfix scan template to verify that these assets have the proper Microsoft patches installed. But if your organization is a medical office, some of the assets in your “Windows Vista” site might also be part of your “Patient support” site, which you may have to scan annually with the HIPAA compliance template.

You can also define an asset group within a site, in order to scan based on a specific logical grouping.

Grouping options for Example, Inc.

Your grouping scheme can be fairly broad or more granular.

The following table shows a serviceable high-level site grouping for Example, Inc. The scheme provides a very basic guide for scanning and makes use of the entire network infrastructure.

A potential problem with this grouping is that managing scan data in large chunks is time consuming and difficult. A better configuration groups the elements into smaller scan sites for more refined reporting and asset ownership.

In the following configuration, Example, Inc., introduces asset function as a grouping principle. The New York site from the preceding configuration is subdivided into Sales, IT, Administration, Printers, and DMZ. Madrid is subdivided by these criteria as well. Adding more sites reduces scan time and promotes more focused reporting.

An optimal configuration, seen in the following table, incorporates the principal of physical separation. Scan times will be even shorter, and reporting will be even more focused.