No prescriptive guide - It's really a process depending on your tools, environment (IT, OT, your specific vertical) and politics (Layer 8!). The Prescription is to identify and minimize (eliminate!) all unknown endpoints using whatever you've got (or can afford). Identify the areas you believe present the biggest risk(s) to the business and start there.
You will never have 100% automation. Just because you know What something is (according to a tool) doesn't tell you Who owns it, exactly Where it is located, When it was put there, or Why it is there at all. There will still be a strong need for some sort of asset management database or registration tool for various department owners or even individuals to add, update and maintain inventories of devices.
From top to bottom, more automation to least automation.
- ISE Profiles and Profiling Libraries
- Traffic based analytics
- Endpoint Analytics
- Industrial Network Director
- Cybervision
- Stealthwatch
- Cisco Security Technology Partners (using pxGrid to share context-in)
- Analysis of ISE Endpoint attribute database - using Excel or EAT tool (iseeat.cisco.com) - to build your own custom profiles
- Existing sources of truth that may either push to ISE via REST APIs or ISE may query (LDAP, SQL) for MAB authorization:
- Network Tools
- CMDB
- Existing network inventory / asset management database
- Control Systems
- custom device registration systems
- ISE Device Registration Portal for BYOD devices
- Direct Inspection (trace the cable!)
