Attack Surface Management

Chapter 4. Identification and Classification of Assets

The first step for any organization implementing ASM is the identification and classification of assets. This is an integral step because many organizations don’t have a complete understanding of them, leaving unidentified risks that skew their perception of their overall security posture. Throughout the chapter we’ll cover this topic in-depth, offering a detailed, business-centric approach to discerning various assets, their business roles, and their importance within an organizational context. While we’ll address many important variables, the primary goal of this step is to accurately categorize assets to inform and enhance ASM practices.

As you’ll learn, we emphasize the development of a comprehensive asset inventory utilizing asset enrichment. These are vital for understanding the full scope of your organization’s attack surface. By accurately identifying and classifying assets, from hardware and software to data and human resources, we lay the groundwork for ASM.

This process is not just about listing assets. A detailed inventory and classification of assets enables us to better understand the potential vulnerabilities and security gaps that each one may introduce. Understanding all of their interconnections, dependencies, and the possible risks they pose allows you to prioritize security measures and allocate resources effectively.

Identification

Before you can start managing your attack surface, it is important to ...