Attackers, who can be located anywhere in the world, are continuously scanning the
address space of target organizations, waiting for new and unprotected systems to be
attached to the network. Attackers also look for devices (especially laptops) which
come and go off of the enterprise’s network, and so get out of synch with patches or
security updates. Attacks can take advantage of new hardware that is installed on the
network one evening but not configured and patched with appropriate security updates
until the following day. Even devices that are not visible from the Internet can be used
by attackers who have already gained internal access and are hunting for internal jump
points or victims. Additional systems that connect to the enterprise’s network (e.g.,
demonstration systems, temporary test systems, guest networks) should also be
managed carefully and/or isolated in order to prevent adversarial access from affecting
the security of enterprise operations.