Asset management

You can't protect what you don't know you have. Asset management covers acquisition and procurement, assignment of owners, classification, monitoring and inventory, and secure disposal with sanitization, destruction, certification, and data retention.

From purchase to inventory

Procurement should include security requirements: approved vendors, supported products, and warranty and patch commitments. Every asset gets an owner who is accountable for it, and a classification that sets its handling rules. Inventory and enumeration keep a current list of hardware, software, and data so unknown devices stand out.

Disposal and retention

Data retention policies say how long data must be kept, for legal or business reasons, and when it must be deleted. Keeping data too long increases breach impact; deleting it too soon can break the law.

Key terms

Asset inventory

A current record of an organization's hardware, software, and data assets.

Asset owner

The person accountable for an asset's protection, classification, and use.

Enumeration

Discovering and listing assets, such as devices on a network or installed software.

Sanitization

Removing data from media so it can't be recovered, allowing the media to be reused.

Degaussing

Erasing magnetic media with a strong magnetic field, which also makes it unusable.

Physical destruction

Shredding, pulverizing, or incinerating media so data can never be recovered.

Certificate of destruction

A document from a disposal vendor proving that media was destroyed or sanitized.

Data retention

Rules for how long data must be kept and when it must be deleted.

Procurement security

Building security requirements into how assets and services are purchased.

Asset classification

Labeling assets by sensitivity or criticality so the right handling rules apply.