Keeping the Inventory Current

The first inventory is a project. Keeping it accurate is the discipline that determines whether the programme survives.

What decays fastest

Group membership, which changes weekly.

Local administrators, which drift per machine.

Cloud role assignments, which change continuously and are the least visible.

Service accounts, which are created by projects and never registered.

SSH authorised keys, added by engineers directly.

Ownership, which lapses whenever anyone leaves.

The automated refresh

Directory membership, resolved transitively, daily.

Local administrator groups, from endpoint management, weekly.

Cloud role assignments, daily.

Service account list, from services and scheduled tasks, weekly.

Authorised keys, from configuration management or a scan, weekly.

Diff against the previous run and review the changes rather than the whole list. A weekly diff is short and readable; a full inventory is neither.

Alerting on the important changes

Not everything needs an alert. These do.

Any addition to a tier zero group.

Any new account with domain or tenant administrative rights.

Any new privilege path to tier zero, where path analysis is automated.

Any new root-authorised SSH key.

Any change to the vault's own administrators.

Any break-glass account use.

Route them to someone other than the person who made the change, which is the whole point.

The review cycle

Monthly: the diff, reviewed by the platform team.

Quarterly: owners confirm that each privileged account they own is still needed, still has the right rights, and is still used.

Annually: full reconciliation, including asking system owners about application-level administrators that no scan will find.

On departure: the leaver's privileged accounts, owned accounts, keys and standing grants, as an explicit checklist.

Ownership

Every privileged account has a named owner, which is the field that makes the review possible.

A business or technical owner accountable for whether it is still needed, not merely the team that operates it.

Reassigned during offboarding, which almost no offboarding process includes.

Unowned accounts reported as a metric, which should trend to zero and never quite will.

The fields worth holding

Account, system, type, tier, rights summary, owner, shared or individual, authentication method, credential age, last used, and discovery source.

Last used is the field that drives removal. An account not used in six months is a candidate for disablement, and disablement is reversible in a way deletion is not.

Credential age is the field that drives rotation, and it is usually the most alarming column when first populated.

The measure of a working inventory

Time to answer "who can administer this system". Minutes, from the inventory, rather than a week of asking around.

Proportion of accounts with an owner.

Proportion discovered automatically versus by manual declaration.

Age of the newest unreviewed change.

An inventory nobody queries is not maintained, whatever the automation says. The queries are what surface the errors.

The weekly diff

Reviewing a full inventory is impossible; reviewing what changed is a ten-minute job.

Automate the collection from every source.

Compare against the previous run.

Report additions, removals and rights changes, grouped by tier.

Review the tier zero section first, always.

Investigate anything unexplained, which is the entire value.

Keep the history, so that a question about when something changed has an answer rather than an estimate.

Snapshots for later questions

A live inventory answers what is true now. Several important questions are about the past.

Export the full inventory monthly, dated, to storage the inventory's own administrators cannot alter.

Include rights summaries and ownership.

Retain for the period your obligations require.

This answers: who had access on a given date, what the estate looked like at the start of an incident, whether an account existed when a finding was raised.

Cheap to produce and impossible to reconstruct afterwards, which is the argument for starting before you need it.