Ransomware Risks Associated with Aging IT Asset Management Software
Maintaining Secure Maintenance Software
Maintenance software often carries significant operational value, detailing assets, work, downtime, vendors, and compliance. However, outdated versions can pose substantial risks, providing attackers with access, timing, and pressure.
Assessing Risks and Mitigation Strategies
The solution involves adopting a proactive approach, prioritizing ownership, clean access rules, supported software, tested backups, and a well-planned migration strategy for aging systems.
Accurate Inventory Management
To mitigate this risk, organizations must maintain accurate records of their maintenance platforms, databases, mobile apps, vendor portals, remote access methods, reporting tools, and connected asset sources. This inventory should document version numbers, hosting locations, vendor support statuses, owners, administrators, service accounts, and renewal dates:
- Version numbers
- Hosting locations
- Vendor support statuses
- Owners
- Administrators
- Service accounts
- Renewal dates
Prioritizing Access Control
Next, organizations should prioritize access control measures, including:
- Eliminating shared administrator accounts
- Implementing multi-factor authentication (MFA) for remote access
- Regularly reviewing vendor accounts
- Removing inactive users promptly, particularly following staff turnover
- Maintaining extended audit logs to support investigations
Patch Planning and Compatibility Issues
IT and operational teams must collaborate on patch planning to ensure that maintenance systems receive necessary updates while minimizing disruptions to operations. A patch calendar should consider shutdown periods, production peaks, inspection cycles, and vendor support schedules.
Developing a Replacement Plan
Finally, organizations should develop a replacement plan with realistic deadlines to prevent temporary controls becoming permanent excuses.
Balancing Operational Needs with Security Controls
Ultimately, the safest option is one that balances operational needs with sufficient security controls. By acknowledging the risks associated with outdated maintenance software, organizations can take proactive steps towards mitigating these threats and ensuring a more secure environment.
About Author
English