Lion Cipher Lab
Reconcile DHCP, EDR and CMDB records to find unmanaged devices
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
You cannot protect a device you do not know exists. That is why 'Inventory and Control of Enterprise Assets' is Control 1 of the CIS Critical Security Controls, ahead of everything else. In practice no single list is the truth. The DHCP server knows what asked for an address today, but nothing about who owns it. The EDR (endpoint detection and response) console knows what has its agent installed, but nothing about devices without one. The CMDB (configuration management database, the organization's official record of what it owns) knows what someone entered, which is often out of date. Each…
What you'll learn
- why one asset list is never enough
- reconciling multiple sources of truth
- choosing a join key and normalizing it (MAC addresses)
- finding unmanaged, unknown and stale assets
- measuring EDR coverage of what is really on the network
- why naive hostname joins mislead
- CIS Control 1 in practice
Steps in this lab
- Three lists, each wrong in its own way
- Choose the join key, then normalize it
- Write the reconciler
- Run it and read the gaps
- Measure the naive version: join on hostname
- Make it routine, and know when to graduate