Defensive Security Handbook, 2nd Edition

Chapter 2. Asset Management and Documentation

As a whole, asset management is often not considered an information security function. However, we have found that without mature asset management processes in place, your information security program can be jeopardized. Consider how you would deal with the following events without asset management (and if these give you anxiety, it’s a great idea to add them to the list of tabletop exercises you regularly conduct):

1. Exposed public-facing systems that are outdated have been reported on social media.

2. Ransomware is spreading across your internal network by exploiting a known vulnerability.

3. A massive increase in cloud spending has been reported to you by the accounting department.

4. An employee reports their device was stolen.

5. A dump of all of your company’s critical HR records has appeared online.

If your company lacks reliable asset information, each of those scenarios becomes significantly more difficult to resolve. This is because without details on ownership or system managers it’s impossible to know who to contact to take appropriate action, such as patching the system to prevent further damage in scenario 1. Similarly, in the case of a ransomware attack, without an inventory of application versions installed on all enterprise assets, it’s hard to determine which assets are affected and how to stop the spread of the ransomware.

In scenario 3, a lack of asset information could make it impossible to identify which systems ...