Beareye · Exposure
CAASM: unify cyber asset inventory and exposure context
By Steven Carrier Updated on
The CAASM module of Beareye consolidates the inventory of your internal and cloud assets from your existing sources: Active Directory, Azure, O365, GCP, industrial equipment. It normalises and deduplicates these assets, reveals the relationships between them, checks network segmentation, and highlights the attack paths these assets make possible.
- Unified inventory
- IT, OT and cloud
- Developed in France
An inventory spread across ten tools
An organisation’s assets are split between the directory, cloud consoles, IT asset management tools and spreadsheets. None of these sources has the full picture. A forgotten, poorly segmented or over-privileged asset becomes an entry point. CAASM brings these sources together and turns the inventory into something you can act on.
Which asset sources does CAASM bring together?
Beareye’s CAASM module aggregates assets from Active Directory, Azure, O365 and GCP, as well as Internet of Things devices and industrial controllers. It also checks VLAN segmentation to spot missing isolation.
-
Active Directory
Accounts, groups, machines and rights, to spot dormant accounts and excessive privileges.
-
Azure, O365, GCP
Cloud resources, identities and configurations, matched against internal assets.
-
IoT and industrial controllers (OT)
Connected devices and controllers, often missing from IT asset management tools.
-
VLAN segmentation
Checks on network separation, to spot zones that communicate when they should not.
From an asset list to an exposure map
-
Normalise
A common format for assets coming from heterogeneous sources.
-
Deduplicate
An asset found in several sources becomes a single record.
-
Connect
Accounts, machines, rights and services are linked together.
-
Reveal
The attack paths that these relationships make possible come to light.
CAASM feeds the inventory stage of a continuous exposure management programme; to see how this approach compares with traditional vulnerability management, compare CTEM and vulnerability management . To go further: Graph-based attack path analysis (article in French).
CAASM or CMDB: what is the difference?
A CMDB lists assets for IT management, on a declarative basis. CAASM consolidates the internal and cloud inventory from a security perspective: it links each asset to its exposure, its rights and the attack paths it makes possible.
| Criterion | CMDB | CAASM |
|---|---|---|
| Purpose | IT management | Internal and cloud security inventory |
| Point of view | Internal, declarative | Internal and cloud, with access |
CAASM complements EASM , which observes your exposure from the outside, with no access: see the difference between EASM and CAASM .
When does a CAASM become essential?
-
An IT and OT estate that grows with each subsidiary
Each subsidiary brings its own directories and tools: CAASM brings them into a single inventory, with no double entry. -
A cloud migration that multiplies assets
During the transition, resources run both on premises and in the cloud: CAASM tracks both and flags those that escape your controls. -
A segmentation audit ahead of an industrial project
Before connecting an industrial site to the rest of the network, CAASM shows the VLANs and flows that expose its controllers.
Connect to your existing sources
The CAASM module connects to your directories, cloud consoles and IT asset tools to aggregate assets without duplicate data entry.
How many assets does a first CAASM consolidation bring to light?
In a first consolidation with Beareye, the CAASM module reconciles a median of 56 inventory sources per organisation. 99% of the consolidated assets were missing from the CMDB, and up to 20% of the records were duplicates. The starting inventory described only a small part of the real estate.
Aggregated, anonymised data from Beareye’s CAASM module: 20 organisations over two years. Median number of sources actually reconciled per organisation; consolidated assets compared with the initial CMDB; 20% is the highest value observed, not a median.
Sources and references
Frequently asked questions
What is CAASM?
CAASM (cyber asset attack surface management) consolidates an organisation’s internal and cloud asset inventory from a security perspective. It links machines, accounts, rights and services to reveal forgotten assets and the attack paths they make possible.
Does CAASM replace my CMDB?
No. The CMDB serves IT management. Beareye’s CAASM module builds on your existing sources, including the CMDB, to produce a security view: exposure, relationships between assets and attack paths, which a CMDB does not provide.
Does CAASM cover industrial (OT) environments?
Yes. The module includes Internet of Things devices and industrial controllers, in addition to IT and cloud. It also checks VLAN segmentation, a sensitive point in industrial environments.
Do I need to install agents on every asset?
The CAASM module aggregates assets from your existing sources rather than requiring an agent everywhere. The suite exposes an API that lets it connect to all the equipment and tools in your environment, to simplify and automate your workflows.
See all your assets on a single map
A demonstration of the CAASM module shows how Beareye consolidates your internal and cloud assets and reveals their attack paths, in your own context.