All right, asset management.
What is it?
Maintaining the organization's assets, systems, printers, software, hardware
devices, and other spare parts in a cost effective manner helps the growth of the
organization and in fulfilling business goals.
You catalog all your assets, assign it an
asset ID, you inventory it, periodically reinventory.
Your intangible assets, intangibles are
things that you can't really put a finger on.
Financial assets, reputation, human
capital, intellectual property, tangibles are things you can touch physically.
Systems, land, building, other physical assets.
Asset identification methods.
You can use standard naming conventions, which identify each asset with a unique
name assigned to it, like a workstation 4483, file serve 21, etc.
Example, it could be a barcode or RFID tag with a unique number name.
You can also use IP schema, storing the subnet information of all IP
address space and range of IPS used in each subnet.
Then configuration management.
You got change control, you got configuration management.
The idea here is that you manage change in an orderly fashion.
The goal is to reduce or hopefully prevent
any security issues by formal throw methodology testing and documentation.
It's a technical and administrative
process employed to build and ensure the stability of the product's performance,
track the product's real time operation, and keep the product updated all the time.
This deals with patch management and updates.
Our configuration management involves management and planning,
identification, control, status accounting, and verification and audit.
Management and planning is, again, you lay out the infrastructure.
I won't pick these apart too much here,
but it tells settings and baselines, assessment of change recommendations,
recording and reporting baselines, and review of software and hardware.
The configuration review.
Process of verifying the configuration settings of hardware and software, and you
should do periodic reviews to ensure that everything is in compliance.
Security content automation protocol or
SCAP is a standard evaluation process used to validate the security standards of the
organization's network and devices connected to the network.
It's got a couple of components.
You have the open vulnerability assessment
languageand the extensible configuration checklist description format.
Change management.
Managing changes in an orderly fashion.
The process for change management is to number 1 request the change.
Number 2, analyze the impact.
Number 3, approve or deny.
Number 4, implement.
Number 5, document report, round and round.
Again, if a change is required, it needs
to be requested, submitted, validated, verified, etc.
One example of change management tools,
Sunview Changegear Manage, Engine, Service Desk Plus.
You'll be playing with a couple of these in the labs.
That is going to wrap up our module for
Module 8, network security assessment techniques and tools.