What You Have vs. What You Don’t Need

This blog post introduces a series on the Center for Internet Security (CIS) Controls and focuses on Controls 1 and 2, which emphasize creating and maintaining comprehensive inventories of hardware and software assets to improve visibility, reduce attack surface, and enable effective detection and mitigation; it argues that knowing what assets and software an organization runs is a prerequisite to writing useful detection rules and managing vulnerabilities.