What is network dependency mapping?
Network dependency mapping is the process of identifying dependencies between different network assets. Historically this has been a complex task due to reliance on manual analysis of disparate data sets including CMDBs, network telemetry, vulnerability scanners, and endpoint agent data. Even gaining an understanding of your asset inventory has been a historically complex project, despite it’s importance. However, once undertaken and maintained, an organization gains distinct advantages across risk management, business resiliency, zero trust, and incident response through network dependency mapping.
Understanding the relationships between assets
Network dependency mapping empowers organizations to understand the relationships between different network assets. Network assets typically include servers, workstations, other devices, and applications. This enables identifying potential dependencies and interdependencies that may impact the availability or security of assets. Once mapped asset relationships can be programmatically taken into consideration during any IT change or implementation. This is particularly relevant when assets are application components that support the business.
Identifying critical assets
Network dependency mapping helps organizations identify critical assets vital to network operations. This information provides an understanding of the criticality of assets. It can help organizations determine the appropriate level of security controls and measures to implement, as well as the types of threats they are most likely to face. Without this context, all assets are treated equally which inhibits effective prioritization. Especially when many assets share a similar vulnerability for example.
Planning for disaster recovery
Network dependency mapping is useful for planning disaster recovery. Network context enables organizations to understand the dependencies between assets. Contextual intelligence provides insight to identify the potential impacts of disasters. Better planning leads to fewer negative outcomes when trouble strikes.
Identifying vulnerabilities
Network dependency mapping enables the identification and prioritization of vulnerabilities based on business impact. This information ensures the most critical assets are protected first. When critical assets are protected negative impacts on the business are less likely.
Network dependency mapping is important for enterprises to make informed decisions. Enterprise IT teams know their environment while identifying risks earlier. Security teams can respond faster and ensure changes don’t impact operations.
Why is network dependency mapping hard for enterprise teams?
Network dependency mapping is challenging for enterprises for many reasons. The most common of which are:
Complexity
Large enterprises have complex networks with many different assets. Assets include many devices such as servers, workstations, applications, and devices. Understanding the relationships and dependencies between these assets is challenging. Especially as the organization grows. With the adoption of new technologies, complexity only increases as new methods are employed for networking.
Lack of visibility
It is nearly impossible to gain a complete and accurate view of all assets within their network using different data sources. Especially if the data sources are distributed across multiple locations or departments. Manual aggregation and compilation are time-consuming, error-prone, and often incomplete tasks. Siloed teams often result in barriers to visibility as different tools and datasets may not be accessible. The lack of visibility makes it challenging to map dependencies between assets accurately.
Limited resources
Enterprise teams have limited time, budget, and personnel. These limitations make it challenging to effectively map dependencies within their network. Unless there is a new influx of personnel and money, network dependency mapping is a wish list item despite its importance.
Constant change
The landscape of an enterprise’s network constantly evolves. Organizations must be able to adapt to changing dependencies and relationships. This is challenging, especially for enterprises with large and complex networks. A typical example is cloud environments with high-frequency changes. Without the ability to automatically reflect changes, inventories rapidly fall out of accuracy.
Cultural and organizational barriers
Network dependency mapping can also be challenging due to cultural and organizational barriers. Different departments or business units may have other priorities. These differences may not align with dependency mapping strategies. While network dependency mapping is highly valuable, it is often not a shared goal.
How can you converge network dependency mapping and asset management?
Oftentimes overcoming a big challenge can be hitched to the wagon of another project. Every enterprise needs to identify all its cyber assets and software inventories to align to CIS core controls 1 and 2. IT asset management has similar hurdles to network dependency mapping. It relies on network data to identify assets across the network. When that data is converged with telemetry, a foundation for asset inventory management is established on top of which network dependency mapping can be undertaken.
Identifying assets
Network dependency mapping is based on identifying the assets across your network based on network traffic. Sources and destinations of traffic include servers, workstations, mobile devices, and IoT devices. Each device identified helps populate an asset inventory which is a key component of asset management. Ongoing data aggregation enables consistent updates to maintain an accurate asset inventory.
Classifying assets
Network dependency mapping helps classify assets based on their importance, sensitivity, or other relevant characteristics. For example, consider several servers communicating with a common server. These many servers are likely application servers communicating with a database server. Logins can indicate the importance of each application server. This information can be used to document, prioritize, and coordinate the protection of assets. Most important you can ensure resources are deployed aligned to business importance.
Understanding dependencies
Network dependency mapping enables utilizing network analysis and assets to understand direct and indirect dependencies. Consider a server that connects to other servers over HTTPS. We know that this web of connections represents connections between servers to make applications work. We can also look at login sessions to identify application and server owners. We can identify necessary network connections for continued operation with this data.
Identifying vulnerabilities
Network dependency mapping is useful to identify vulnerabilities as stated before. This vulnerability information is also helpful for identifying assets and understanding risk. Organizations can identify the impact of vulnerabilities on other assets and applications based on dependencies between assets. The result is more effective and prioritized remediation of vulnerabilities.
Network dependency mapping is a useful tool for effective asset management. It extends beyond business resilience to continuously improved risk management.
How do CISOs justify spending money on network dependency mapping?
Everything is a balance between cost and benefit. Demonstrating strong ROI across existing projects and resources is very important. Below are four ways cyber security teams justify network dependency mapping.
Risk assessment
Network dependency mapping streamlines how you discover risk and determine threats that impact the business the most. Cyber security teams discover their assets and their dependencies quickly. They can then allocate resources to remediate those that reduce the most amount of risk to the business. Most importantly, they can deprioritize those that are less important.
Cost savings
Network dependency mapping helps cyber security teams identify opportunities for cost savings. A simple example is identifying underutilized or unnecessary assets for decommissioning. Or identifying costly and risky applications for refactoring. Cyber security teams justify the investment in network dependency mapping through cost optimization.
Compliance
Network dependency mapping supports organizations to meet regulatory and compliance requirements. Common examples include the General Data Protection Regulation (GDPR) and Payment Card Industry Data Security Standard (PCI DSS). Through accurate asset identification and classification, organizations ensure that they comply with relevant regulations and standards. Common examples include validating appropriate security control coverage and minimally permissible access.
Business continuity
Network dependency mapping is valuable for ensuring business continuity. When organizations understand dependencies between assets they understand the implications of a disaster. Cybersecurity teams can focus on the availability and resilience of the organization’s assets. The outcome is earlier detection and faster response to ensure business operations are not impacted.
Conclusion
Network dependency mapping provides valuable benefits to an organization. Enterprises gain improved risk assessment, cost savings, compliance, and business continuity. These benefits help cyber security teams to justify the investment in network dependency mapping. Moreover, it empowers effective resource management to do more with less.
Network dependency mapping has been a historically complex undertaking, but not anymore. appNovi consolidates network dependency mapping with asset management through integrations with existing tools for free. Customers benefit from total asset visibility through discovery and gain business context through data convergence. Analytics power automated outcomes to eliminate manual intervention while visualization enables faster response. appNovi is a Cyber Security Mesh Architecture (CSMA) platform that supports physical infrastructure, SDN, and public cloud for total visibility.
