Lesson 1.70: Asset inventory and data classification
You can't protect, value or patch what you don't know exists. That's why asset inventory is the first safeguard in the CIS Controls and an early control in ISO/IEC 27001 (5.9). An inventory is useful only if every asset has an owner and a classification that says how carefully it must be handled. In the lab you check Northwind's inventory: how its assets are classified, which ones have no owner or label, which machines on the network aren't in the inventory at all, which entries are stale, and which assets are the crown jewels.
16 min
You will learn to
- Explain why inventory comes first
- Read a classification standard
- Find assets without owner or classification
- Compare the inventory with what is on the network
- Identify the crown jewels
Key terms
- Asset inventory
- The list of hardware, software, services and data an organisation has, with owner and details.
- Asset owner
- The person accountable for an asset's protection and use.
- Classification
- A label for how sensitive information is and how it must be handled.
- Shadow IT
- Systems running without the knowledge or approval of IT and security.
- Crown jewels
- The few assets whose loss would hurt the organisation most.
← Assets, threats, vulnerabilities and risk · All lessons · Spending a security budget for the most risk reduction →