https://www.sans.org/reading-room/whitepapers/critical/technical-implementation-critical-control-inventory-authorized-unauthorized-dev-36357