Lesson 2.59: Security dashboards: garbage in, garbage out
Every metric on a security dashboard rests on an inventory: how many assets, who owns them, which have endpoint protection. When the inventory is merged from several sources (a CMDB, a scanner, an EDR console), the same machine appears twice, owners are missing and machines that were switched off months ago are still counted. The result can make coverage look worse or better than it is. In the lab you check the data behind Northwind's draft dashboard for duplicates, missing owners and stale records, recompute the coverage and write the corrections.
16 min
You will learn to
- Explain why merged inventories produce wrong metrics
- Find duplicate records, including case variants
- Find assets without owners
- Find stale records by last-seen date
- Recompute a coverage metric on clean data
Key terms
- CMDB
- Configuration management database: the official inventory of systems and their owners.
- Duplicate record
- The same asset counted more than once, often from different sources or spellings.
- Stale record
- An entry not confirmed by any source for a long time.
- Shadow IT
- Systems running without being registered or owned.
- Coverage metric
- The share of assets with a control in place, e.g. EDR.
← ISO/IEC 27001 and the Statement of Applicability · All lessons · Regulatory horizon scanning →