There is a fundamental axiom in cybersecurity that every IT Manager should have engraved on their desk: "You cannot protect what you don't know you have". Any Risk Assessment activity that skips the Discovery phase is doomed to fail, leaving blind spots where risks proliferate unchecked. Welcome to the first chapter of our operational Playbook.

1. The Invisible Enemy: Shadow IT

Shadow IT represents the collection of devices, software, and cloud services used within the company without explicit approval from the IT department. This could be a Wi-Fi access point installed by an employee for "better signal," or an entire database moved to a personal cloud account for convenience. From a risk perspective, Shadow IT is a landmine: it is unpatched, unmonitored, and often exposes critical data to the Internet.

2. Discovery Techniques: Active vs Passive

To map the infrastructure and flush out Shadow IT, we must adopt scanning strategies that do not impact business continuity, especially in Industrial (OT) or Medical environments:

• Active Discovery: Directly querying assets (ping, port scanning). Highly precise but can be "noisy" or crash sensitive legacy devices.
• Passive Discovery: Listening to network traffic via SPAN/Mirror ports. Non-invasive, perfect for identifying assets that "talk" spontaneously, but less effective for silent ones.

3. The Toolset: Open and Commercial Solutions

The choice of tool depends on network scale and the need for automation. Here are the market benchmarks every professional should know:

• Open Source Solutions:
  • Nmap: The "Swiss Army knife." Indispensable for specific discovery and OS fingerprinting, but requires high technical skills to scale.
  • Netdisco: Excellent for mapping network topology via SNMP, allowing you to see exactly which switch port each device is connected to.
• Commercial Solutions:
  • runZero (formerly Rumble): Likely the most innovative tool today. It performs "unauthenticated" (credential-less) and agentless active discovery, identifying IT, OT, and IoT assets with surgical precision without crashing systems.
  • Lansweeper: A complete IT Asset Management solution that combines network and agent-based scanning to maintain an up-to-date CMDB.

4. Conclusion

Without a granular and dynamic asset inventory, the risk calculation (ALE/ARO) discussed in previous posts remains a theoretical exercise based on partial data. Visibility is the prerequisite for security.

Index: IT Risk Assessment Playbook

• Ep. 1: Asset Visibility and Shadow IT [You are here]
• Ep. 2: Threat Modeling: Knowing the Adversary
• Ep. 3: Framework Comparison: NIST vs FAIR
• Ep. 4: The Risk Register: From Theory to Governance