In this lesson,
we're going to talk about automating network inventories.
Now, these days in our modern networks,
it is crucial that you have an automated way
of conducting network inventories
because we're using things like virtual machines
and virtual environments all the time.
These virtual machines aren't things
you can walk around the office and count by touching them
as you're walking desk to desk.
Instead, they're just a series of ones and zeros.
So you have to be able to have a way to track
and maintain an inventory of all these different things,
especially as your systems are constantly scaling up
or scaling out in the case of vertical
or horizontal scaling.
So let's talk a little bit
about automating network inventory,
because maintaining this up-to-date inventory
is not just needed for logistical necessity,
but it's also a strategic imperative inside of your business
because you have to keep track of everything,
from the computers you're using to the virtual machines
and the cloud services you're using,
all the way out to the licenses you're using
for the pieces of software.
Now to do this, we're going to use automatic network inventory
by creating a dynamic, efficient, and reliable approach
to keeping track of every device, user, and software
within our enterprise network.
Now, the heart of this is these dynamic inventories,
and this is a transformative leap
going from our static manually managed list
that we used to have
into a real-time automatically updating repository
of all of our network assets.
Now, some of the benefits of this
is that you can have a real-time update,
unlike having a static list where you went around
and did a quarterly count of all the computers
that were issued to employees.
When you're using this type of automation
of a dynamic inventory,
you're going to have an automatic update
as soon as the device joins or leaves the network,
so you'll know exactly what is connected
and what risk your network has at that time.
This means that you as a network administrator
or network engineer will always know
who is connected to your network and how many users you have
because of this real-time updating capability.
Another great use of automation
with your dynamic inventories
is to have an integration with other management tools.
For example, your dynamic inventories can be integrated
with other network management tools
like Ansible, Chef, and Puppet.
This type of integration
allows for the automated configuration
and management of those devices based on the real-time data
collected from the real-time updates and inventory.
And this, again, streamlines your network operations.
The third big benefit here
when you're dealing with automation
is that it reduces human error.
Because we're automating the inventory management process,
we're not having to spend people's time and energy
walking around and counting computers,
and we're going to reduce human error
because I can tell you
having done lots of manual inventories in my career,
people always miss something
and we spend weeks trying to figure out
where is that one laptop
that nobody knows where it is anymore
because somebody forgot to unlock an office
and we didn't think to check it.
These are all the things that get reduced or eliminated
when you move to real-time updates using automation.
Now, another way you can do this
is you can use a one-time scan that is done either on demand
or you can schedule to do it once a week
or once a month using a tool like Nmap.
Now, Nmap stands for Network Mapping
and its job is to go out and conduct IP scans
and port scans across your network
to figure out what devices are on the network.
For example, is there a laptop or desktop
on that particular switch port
and what services are being run on each of those machines?
For example, if you have a computer on your desk at work
and you're running a web server on it,
that means Port 80 and Port 443 are likely going to be open,
but that also represents a vulnerability on that network,
and so your network administrators need to know that.
And by doing these type of port scans,
they can figure that out
and then they can visualize that information as well
inside of a tool like Zenmap
or other tools like SolarWinds' Network Topology Mapper
or the Intermapper.
All of these have things
where you can do the layout of your network
and understand what ports are open,
and then conduct an impact analysis
so you can better protect your network
and prevent it from going down
from any kind of single points of failure because again,
you can identify those things by having this network map.
The final area I want to talk about
is security and compliance.
Now, when it comes to dealing with automated inventories,
this also helps feed into our security
and compliance programs
because if we're going to be subject to the rules of PCI DSS
because we accept credit cards,
there are certain requirements of what things can
and cannot be in your inventory
in the particular screen subnet
that the payment card systems live
because that would either increase or decrease
the security of that particular screen subnet.
So all these are things that go into it,
and when you're doing this dynamic real-time updating,
you can configure things to say,
hey, if somebody connects a laptop into our PCI DSS subnet,
we want to immediately notify the administrators
and block that and quarantine it.
That way, data can't be exfiltrated from the database server
that holds everybody's credit card numbers
onto somebody's laptop
that they happen to plug into a network switch
that was tied to that particular subnet.
These are the kind of things we're thinking about
when we're dealing with automated inventory.
It allows us to go out and figure out
what's on the network in terms of hardware,
software, versioning, ports, protocols, and anything else,
and get a real-time picture of what our network looks like
so we can better defend it and better secure it.