How to identify and remove ‘ghost assets’ from your organization

Halloween may still be a month away, but something frightening may be haunting your business in the meantime: ghost assets.

Ghost assets cannot be accounted for, but still show up on a company’s inventory list. For example, they might include devices that have been lost, misplaced, or stolen.

“They could be left in a desk drawer. They could have left with an employee who took it with them when they departed the organization,” Mitch Berk, VP of product management and autonomous endpoint management at Ivanti, said. “They could have been recycled and not deleted from the systems, but it’s an accounting or systems error where things aren’t reconciled.”

Henrique Teixeira, SVP of strategy at Saviynt, told IT Brew ghost assets can also include digital assets, including accounts and identities.

“A ghost account is when…somebody leaves the company, and all those accesses that were created, people just forget. They forget they were even created,” Teixeira said. “And what happens is it becomes like a backdoor to your organization because somebody could use my old Henrique account to access my files and to access other corporate systems.”

How do businesses get “haunted”? Berk said ghost assets are often the side effect of having disparate systems, which leads to a breakdown in business processes. “They may have a ticketing system that manages IT requests. They may have an HR system. They may have a device management or a device security system,” Berk said. “And if those aren’t all talking to each other and giving you one system of record to have that holistic view, then they can get out of sync.”

The risks. Ghost assets can pose several problems for organizations. For one, BlueVoyant CISO John Harbaugh said ghost assets can serve as an unknown risk surface that autonomous adversaries can quickly take advantage of.

In addition to the cybersecurity concerns, ghost assets can lead to unnecessary costs for an organization. “You could still be paying a lease on them. You could still be paying insurance on them,” Berk said. “They’re something that you’re carrying in your books.”

Ghost assets can also present a compliance risk if, during an audit, a company is unable to prove that a piece of missing hardware doesn’t contain sensitive information, for example.

“That’s either a potential compliance exposure or an actual risk if the data did potentially leave the organization and wasn’t properly disposed of,” Berk said.

Ghost hunting. If you suspect your organization is home to physical ghost assets, Berk said the first thing to do is figure out the last person in possession of the device and the last time it was connected to the network.

“The biggest risk is, ‘Was their data on there?’ If it was your HR person’s laptop and it had all of the employee records on there, that’s a problem,” Berk said. “You want to make sure that whoever the last user was, all of their credentials have been expired or reset if they’re still with the company, so that that asset loses its keys to connect back to the enterprise.”

The device should also be blacklisted or blocked from accessing a specific system or network, he added.

The procedure is similar for identity-related ghost assets, according to Harbaugh. IT pros should piece together details like when the account was last used, who logged into it, and the type of activity that occurred on it. Asking these questions, he said, will give a company a better idea if malicious activity occurred between when the ghost account was created and when it was found: “It’s almost like you’re doing an incident investigation without an incident to trigger the investigation.”