Asset Management

Asset management is a huge part of managing risk for a company. In fact, it's so important that most companies and organizations already have a way of tracking assets and managing those assets, and largely it's carried out by the accounting department. They're the ones that have processes and procedures in place to manage assets. But the thing is, that overlooks a few key assets to the company, so you have to take that broader perspective of how to manage assets.

What counts as an asset

An asset is just anything that has value to the company. So for instance, cash or money that they have on hand is a value to the company. Also we have things like data. Data is not a direct monetary value, but perhaps we have some sort of correlation that we could attach a monetary value to it. Maybe it is that we could sell that data or utilize it for some purpose. We should be able to justify keeping that data on hand because of some value that it has, and at some point in time we should be able to render that down into a monetary value.

Same thing, we might have some code or software that has some sort of asset value to us. Maybe it's the company reputation. Maybe it's the building and equipment that we have. Maybe it's the customers and the customer information that we have. Perhaps it's the employees of the company. Maybe it's other things like laptops, desktops, servers and other physical equipment that we have.

Different assets, different processes

Now the thing is, with each one of these assets we may have a different process to manage each one of these. For instance, if it's cash or money or budget, that's all managed by accounting practices that we have for the firm, and also they get audited. There are auditors that will come in and audit those practices to make sure that we are doing them correctly.

There's also data. Data is an asset that we may manage quite a bit differently than the rest of our assets. In fact, so much so that I include that in a whole other module. We're not going to cover it in this module, because the practices of managing data can be so different than everything else.

But let's say we're a software company. We could be developing code, and so that code is going to be an asset to us, and how we manage that is going to be really important. Or maybe it's just the software license we purchase so that way we can utilize it developing that code or doing other business practices. Or we could be utilizing software as a service, which is not a typical asset because we don't own it. In fact, it's something that we pay out for, but I'd like to include it as one of the assets because it most likely has some data inside of it, and we need to manage the risk to that data that's inside of those online cloud services that we're utilizing.

There's also reputation. We might be able to charge more for our product because we have a reputation behind it, because we have an understanding what service we guarantee behind whatever product that we're selling. I was part of a company that probably their most expensive asset, or their most valuable asset, was their URL. It was a very short URL that was really sought after, that was worth over a million, perhaps millions of dollars. So that can be a really great asset for the company as well.

There are something called capital projects, that a lot of times accounting practices will also capture those capital projects, and you're going to have to fall into managing those capital projects a little differently than the rest of your assets. And then there's just those regular purchases that you make, the laptops and the desktops and the tablets and everything else, that you would manage in a little different way than the rest of these assets.

There are times when we lease or rent things. As an example, I gave using software in the cloud, where we don't actually own anything, we're just subscribing to a service. Or a building that we're renting, or perhaps it's products that we are leasing. So there are examples of this, but I'm going to throw it into here as an asset. Even though we don't own it as a company, we probably still want to track those things, because number one, the value that they have, but number two, there could be risks that are associated with that. So I'm going to throw in here with the asset management anything that we're leasing or renting that has some sort of value to the company as well.

The asset life cycle

Just like most everything, assets have some sort of life cycle. There's a beginning, middle and end to it. It starts out with acquiring or procuring some sort of asset, and we should have some sort of process to make sure we're getting the right asset that's going to meet our needs. Then we go through a process of accounting for that asset, that somehow we need to track that asset, and perhaps we assign it out to an individual or a department, and so there's an assignment and accounting that happens with that. Then there's a maintenance part of this, where we need to make sure we maintain that; perhaps there's some sort of service that needs to be performed on it, or maybe we just need to be tracking it, maybe there's some sort of inventory that we need to take on a yearly basis. Then there's some sort of change that happens, maybe we need to assign that to somebody else, so there's a change management process of this. And then at some point in time that asset is going to become outdated, or whatever the case may be, and we're going to have to go through a deprovisioning of that asset.

A great example that I'll use quite often here is going to be a laptop. First of all we're going to determine what brand and model we want to purchase, and then the vendor we're going to purchase it from, do some evaluations, maybe get some quotes, and we're going to go through this acquiring process. Once we do that, then we're going to have to track this laptop. A laptop can easily be stolen, so we want to make sure that we're doing some sort of accounting on it, and we assign it to an individual that's going to be responsible for that laptop. Then we go into maintenance mode, that we need to make sure that the proper software is on there, that it's getting updated, that there is security involved on this laptop, so we go through the maintenance side of this. Then what might happen is maybe that user is going to leave and we're going to reassign that laptop to another user, so there's some sort of change management process that happens throughout here. Then once that laptop is older and needs to be replaced, we're going to deprovision that laptop and make sure that it's sanitized before we get rid of it.

Classifying assets: value and data sensitivity

Now what I've found is that there are different types of assets and how critical they are, and based off of that I might take different routes. So for instance, there are some assets that I would do a more intense acquisition process, where I do a lot of research into it. Or maybe I'm going to do quite a bit more management towards certain products and services. Or perhaps the de-provisioning process is going to look different, and it's going to be based off of asset classification.

There are two things that really are the key factors in how I manage an asset. The first one is that asset value or cost. The second one is the data sensitivity that's stored within that asset.

From a value or cost perspective, if it is something that's very low cost — let's say we're purchasing a service online and it's maybe 10 bucks a month, so it's pretty cheap for a business to afford $10 a month for maybe just a single instance of it — I'm not going to spend much time at all evaluating this, managing this. I might just say let's give it a try, I'm going to pay the 10 bucks a month and try it out and see how it goes. But if this was something that's going to cost thousands or tens of thousands or hundreds of thousands a month, then I better put a lot more time and effort to make sure that this product is going to meet our needs, that it's worthwhile transitioning over to it, that I'm going to manage it correctly. So based off of the value and the cost, I'm going to have different levels of how I manage these different assets.

The other thing that I really analyze is what is the data classification that's being stored on it. Let's say it's a product like a laptop: what is the data on that laptop? Or maybe it's a service up in the cloud: what data are we storing in the cloud? If it's just unclassified or public, then I'm not as concerned about it. However, as we go up in this sensitivity of the data, so if it was top secret or confidential, then I'm going to put a lot more time into making sure that this product is going to remain secure, that we are managing it correctly. So based off of the data classification, I'm going to classify this asset in accordance with whatever data is being stored on it.

How asset management relates to other functions

Now, asset management relates to a lot of other functions that we do within security operations. For instance, data management is just a type of asset management, since data is a type of asset. Also, good asset management will really help us out with vulnerability management and risk management. We can be better prepared for these two processes if we're doing asset management correctly, that we can analyze those, manage those assets for risks and also for vulnerabilities, to make sure that we're securing those assets. It also is directly related to vendor and supply chain management, because we have to get these assets from somewhere, so we're going to not only evaluate the product, but we're going to evaluate the vendor and the supply chain to make sure that they're secure when we're purchasing some sort of product.

I'm going to use several examples throughout this module. For instance, I'll use some hardware like firewalls and laptops, and this is great because we can more easily conceptualize this, we can visualize it, because it's an actual product. But I'm also going to talk about several other examples, like a customer relationship management software, CRM software, that manages our relationships with all of our customers, or unified communications as a service software, things like our phone systems. So I'm going to talk about a few other examples through here so we get some perspectives on different ways.