- Welcome to lesson 15, explain the security implications
of proper hardware, software, and data asset management.
Now, in our first lesson in lesson 15
we're gonna be talking about assets and asset management.
Now, an asset is any data, device or component
that's of value to the organization.
And every asset should have an assigned owner
and a custodian.
Now, our owners are responsible for decisions related
to classification, and we talked about that when we talked
about classification and access control
as well as oversight of protection mechanisms.
So the two key words when we're talking
about owners are going to be decisions
and oversight, decisions and oversight.
Now, our custodians, really what you and I do
in our day-to-day jobs are responsible
for the implementation, the management
and the monitoring of controls.
So we're the hands-on folks,
we're doing the implementing, managing and monitoring
but we're also going to be advising owners
on what controls they should put in place
as well as educating owners and our entire user community
about the controls and how to use them.
So let's talk about asset management.
Asset management is a set of activities that focus
on the acquisition, the management, and the accounting.
Where are they, who has them?
What's the end of life of assets inclusive
of inventory management and classification?
Now, a sub component or a supporting component
of asset management is going to be inventory management.
And that's gonna be our policies, our standards
and our procedures to track and maintain
and replace our assets.
And of course, classification ties closely
into asset management because that's the process
of organizing our assets by criticality.
We said that physical and infrastructure assets
are very often organized by operational criticality
and/or sensitivity.
And usually our data is organized by sensitivity.
And we covered that in our whole classification lesson.
So what are some tools that we can use to really
get a good handle on our inventory?
While we have network mapping tools,
network enumeration tools, and software auditing tools.
Now, network mapping tools are used
to create physical and logical diagrams.
Now, some popular network mapping tools
include SolarWinds and Spiceworks
and ManageEngine and Nmap.
Network enumeration tools are used to actually discover
and document devices as well as their characteristics.
Popular enumeration tools include DumpSec and Nessus.
And then software audits tools are designed
to track licensed and unlicensed software.
Part of our compliance requirements, and really part
of just being a good human being, right,
is to honor software licenses,
to not be using unlicensed software
which really is just illegal as well.
So every asset should have a lifecycle management plan.
Now, lifecycle management plan covers all aspects
of the product lifecycle from the day we acquire it
all the way to its end date.
And we always wanna be preparing for that end date
because preparation for end date mitigates the risks
of serious vulnerabilities associated with end of life
and end of support and unexpected or unnecessary downtime.
So what are those asset end dates?
Well, we have the notification date.
That's number one.
We have the last sale date, number two.
We have an end of life date, number three.
And we have end of support, which is number four.
So let's talk about those end of date milestones.
Notification, end of sale, end of life, and end of support.
The notification date is a date when the end of sale,
end of life and end of support milestones for a product,
for a service or subscription is going to be communicated
to the general public.
Now, for some publishers or manufacturers
they do that right on the date of the product release.
Others may not be so sure and so you'll have
to sort of stay in touch with them
to find out what those dates are going to be.
Now, the end of sale date is a date when the product
or service or subscription is no longer available for sale.
You can't buy it anymore.
The end of life date, which we talked about before
is the date when a product or subscription or service
is determined to be obsolete.
And once obsolete, the product or subscription
is not going to be sold, maintained, or improved.
That means there's no more features, no new functionality,
it's not improved at all.
And then we get to that end of support date
which is the last date to receive applicable
service and support.
Now, that's bad, right?
If we don't wanna be running anything past then
we won't get any more service and support.
And really critical here is after this date,
updates are no longer available.
Most vendors have very clear policies
about the lifecycle of their products.
Those vendor lifecycle policies establish predictable
guidelines for product support and servicing timetables.
Now, they may have either a fixed
or what's known as a continuous,
sometimes referred to as a modern, lifecycle.
A fixed lifecycle is products
with a defined date at the time of release.
But more and more we're seeing this continuous
or modern lifecycle and these are products
with continuous support and servicing.
But the key is that customers must take the latest update
to remain supported.
We're gonna, one more time, we're gonna talk
about our end of life and end of support risks.
Whenever possible, right, it's so important
that our hardware and software
should be refreshed prior to end of life
'cause we'll have no more features or functionalities
and definitely before end of support, well,
because we're not gonna have any support, any help
and we won't have any patches.
Just a reminder that our adversaries will continue
to identify and exploit vulnerabilities,
that almost every regulation requires
that organizations take reasonable steps to protect the data
and systems under its control.
And not doing so can be considered a compliance violation.
So having end of life or end of support products
or services or subscriptions would definitely
not be considered a reasonable step, right?
The reasonable step would be to refresh them.
Now, you could have exposure to litigation
for not upholding the standard of due care.
Due care is the standard
that a reasonable person would follow.
You have risk of downtime due to lack of support
and service resolution.
And you probably will have incompatibility
with newer operating systems, applications and hardware.
So I know we've talked about this a number of times
but I do expect this to come up on your exam
and it will definitely come up in real life
in your day-to-day practice.
And with that, we have a three second challenge.
Challenge one, the date when a product, service
or subscription is determined to be obsolete.
1, 2, 3.
That's gonna be end of life.
Number two, the lifecycle policy for products
with a defined end of support date at the time of release.
1, 2, 3.
That's gonna be a fixed lifecycle.
Number three, after this date updates are available
by exception only.
Hmm, we didn't really talk about this
but take your answer and then we'll talk about it.
1, 2, 3.
That's end of support.
So at the end of the support time updates aren't available
but sometimes, sometimes there are exceptions.
And Microsoft has been notable with this.
Some of their Windows products that are way outta date
are still being used worldwide.
And every once in a while when there's a really,
really critical vulnerability, they will actually reach back
and release a patch for that critical vulnerability.
But it's definitely, definitely by exception only.
Number four.
The tool used to create physical and logical diagrams.
1, 2, 3.
That's a network mapping tool.
And number five, the process of organizing assets
by criticality and or sensitivity.
1, 2, 3.
And that's classification.
That brings us to a security-in-action
so we can practically apply our knowledge.
And this one's about asset management.
Now, one of the findings of a recent IT audit is
that there is no inventory of IT assets.
When this finding is presented at the audit exit meeting,
the IT manager defiantly responds that "we're a small
company and my team is well aware of what the company owns."
Okay, what's your response?
You're sitting there, what do you say?
So just a a quick recap.
We just had this recent IT audit.
There was no inventory of IT assets.
Findings presented at the audit exit interview
and boy, the IT manager doesn't like that.
He's like, yeah, well, we know what we have
so we don't need to have an asset inventory.
Do you agree?
What do you think?
Go ahead and put me on pause.
Think about this one for a sec and
come on back with your response.
Well, very succinctly, you can't protect
what you don't know you have.
Let's say that again.
You can't protect what you don't know you have.
Inventory management is really the foundation
of vulnerability and patch management.
How can we have vulnerability
and patch management work appropriately
if we don't even know what we're protecting?
So inventory management is also critical
for tracking equipment and for facilitating
recovery of lost or stolen assets
as well as end of life replacements.
We need to have the inventory,
we need to know end of life dates, end of support dates,
that allows us to create our refresh policies.
Again, if we don't know what we have,
we can't do any of that.
And software asset management is really necessary
for license compliance.
Again, if we don't know what we have,
how do we know that we're in compliance with our licenses?
So the IT manager is probably very talented
at what he or she does, but it's really important
from an organizational perspective,
a risk management perspective, right,
that we have an accurate inventory of our assets
and those assets should have owners and custodians.
Those assets should be included
in our vulnerability and patch management.
We should, and as well as in our refresh policy
so that we don't reach, you know,
end of life or end of support dates.
And of course to ensure that we are in compliance
with all licensing requirements.
And doing that, my friends, is security in action.
That brings you to your word map.
You know what to do.
Make sure you're all really comfortable
and confident in every one of these terms.
And when you're ready, head on over to the next lesson.
I'll be waiting for you there.