4.2 Asset Management

Question 1

Acquisition/procurement process

Answer 1

The purchasing process
– Multi-step process for requesting and obtaining
goods and services
* Start with a request from the user
– Usually includes budgeting information and formal
approvals
* Negotiate with suppliers
– Terms and conditions
* Purchase, invoice, and payment
– The money part

Question 2

Assignment/accounting

Answer 2

A central asset tracking system
– Used by different parts of the organization
* Ownership
– Associate a person with an asset
– Useful for tracking a system
* Classification
– Type of asset
– Hardware (capital expenditure)
– Software (operating expenditure)

Question 3

Monitoring / asset tracking

Answer 3

Inventory every asset
– Laptops, desktops, servers, routers, switches, cables,
fiber modules, tablets, etc.
* Associate a support ticket with a device make and model
– Can be more detailed than a user’s description
* Enumeration
– List all parts of an asset
– CPU, memory, storage drive, keyboard, mouse
* Add an asset tag
– Barcode, RFID, visible tracking number, organization name
– Media sanitization
* System disposal or decommissioning
– Completely remove data
– No usable information remains
* Different use cases
– Clean a hard drive for future use
– Permanently delete a single file
* A one-way trip
– Once it’s gone, it’s really gone
– No recovery with forensics tools
* Reuse the storage media
– Ensure nothing is left behind

Question 4

Physical destruction

Answer 4

Shredder / pulverizer
– Heavy machinery - complete destruction
* Drill / Hammer
– Quick and easy
– Platters, all the way through
* Electromagnetic (degaussing)
– Remove the magnetic field
– Destroys the drive data and renders the drive unusable
* Incineration
– Fire hot.

Question 5

Certificate of destruction

Answer 5

Destruction is often done by a 3rd party
– How many drills and degaussers do you have?
* Need confirmation that your data is destroyed
– Service should include a certificate
* A paper trail of broken data
– You know exactly what happened

Question 6

Data retention

Answer 6

Backup your data
– How much and where?
– Copies, versions of copies, lifecycle of data,
purging old data
* Regulatory compliance
– A certain amount of data backup may be required
– Emails, corporate financial data
* Operational needs
– Accidental deletion
– Disaster recovery
* Differentiate by type and application
– Recover the data you need when you need it