5.1 Describe management concepts

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

1. What is Asset Management?

Asset management is the process of identifying, tracking, organizing, and protecting all IT assets in an organization.

An asset is anything valuable to the organization that needs to be protected.

In cybersecurity:

Asset management helps security teams:

Know what exists in the environment
Understand what needs protection
Detect unauthorized or unknown systems
Respond quickly to security incidents

2. What is Considered an Asset?

In an IT environment, assets include:

1. Hardware Assets

Physical devices:

Servers
Laptops and desktops
Network devices (routers, switches, firewalls)
Mobile devices
Storage systems

2. Software Assets

Programs and applications:

Operating systems (Windows, Linux)
Installed applications
Security tools (antivirus, SIEM)
Custom-developed software

3. Data Assets

Information stored or processed:

User data
Credentials
Logs
Databases
Backup files

4. Network Assets

Network-related components:

IP addresses
Subnets
DNS servers
Cloud resources

5. Virtual and Cloud Assets

Non-physical resources:

Virtual machines
Containers
Cloud storage (e.g., object storage)
Cloud services (AWS, Azure)

3. Why Asset Management is Important for CyberOps

Asset management is critical because:

1. Visibility

You cannot secure what you do not know exists.

Helps identify all systems in the environment
Detects unknown or rogue devices

2. Risk Identification

Different assets have different risk levels.

Critical servers = high risk
Test systems = lower risk

3. Incident Response

During a security alert:

Analysts must quickly identify:
- What system is affected?
- What data is stored?
- Who owns it?

4. Vulnerability Management

Security teams need asset data to:

Scan systems for vulnerabilities
Apply patches correctly

5. Compliance

Many standards require asset tracking:

ISO 27001
NIST
PCI-DSS

4. Asset Inventory (Key Exam Concept)

An asset inventory is a central list (database) of all assets.

It typically includes:

Asset ID
Hostname
IP address
Owner (user or department)
Location
Operating system
Installed software
Security classification

Example (IT-focused):

Asset Type	Hostname	IP Address	Owner	OS
Server	web01	10.0.0.5	IT	Linux
Laptop	user-pc1	10.0.1.10	HR	Windows

5. Asset Classification

Assets are classified based on importance and sensitivity.

Common classifications:

Critical – Essential systems (e.g., authentication servers)
High – Important business systems
Medium – Standard systems
Low – Non-critical systems

Data classification levels:

Public
Internal
Confidential
Restricted

Why classification matters:

Helps prioritize security controls
Helps decide:
- Which systems need stronger protection
- Which incidents are more serious

6. Asset Ownership

Every asset must have an owner.

Asset owner responsibilities:

Approving access
Ensuring proper use
Reporting issues
Supporting incident response

Important distinction:

Owner ≠ person using the system
Owner = person responsible for the asset

7. Asset Lifecycle

Assets go through different stages:

1. Procurement

Asset is purchased or created

2. Deployment

Installed and configured

3. Maintenance

Updates, patches, monitoring

4. Retirement

Decommissioned and removed

Security importance:

Old systems may become vulnerable
Retired assets must be:
- Wiped (data removal)
- Removed from inventory

8. Asset Tracking Methods

Organizations track assets using:

1. Manual Tracking

Spreadsheets
Simple but error-prone

2. Automated Tools

Asset management systems
Network scanning tools
Endpoint management tools

3. Agent-Based Tracking

Software installed on devices
Reports asset data regularly

4. Agentless Tracking

Uses network scanning (e.g., via IP range)

9. Configuration Management Database (CMDB)

A CMDB is a centralized system that stores:

Asset information
Relationships between assets

Example relationships:

Application → runs on → Server
Server → connected to → Network switch

Why CMDB is important:

Helps understand dependencies
Helps in troubleshooting and incident analysis

10. Asset Management in Security Monitoring

Security analysts use asset data to:

1. Investigate Alerts

Example:

Alert shows IP: 10.0.0.5
Asset inventory tells:
- It is a production web server
- Owned by IT team

2. Detect Unauthorized Assets

Unknown device appears in logs
Not in asset inventory → suspicious

3. Prioritize Alerts

Alert on critical server → high priority
Alert on test system → lower priority

11. Common Asset Management Challenges

Missing or outdated inventory
Shadow IT (unauthorized systems)
Cloud assets changing quickly
Lack of ownership information
Poor integration between tools

12. Key Exam Points to Remember

For the CBROPS exam, focus on:

Asset = anything valuable (hardware, software, data, network)
Asset inventory = central list of assets
Asset management provides:
- Visibility
- Risk awareness
- Better incident response
Classification = defines importance/sensitivity
Ownership = accountability
Lifecycle = procurement → deployment → maintenance → retirement
CMDB = stores asset details and relationships
Unknown assets = security risk

13. Quick Summary

Asset management is the foundation of cybersecurity because:

It tells you what exists
It helps you protect what matters most
It allows faster and more accurate incident response