Domain 5 of 5 · Chapter 4 of 5

Understand Asset Protection

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Asset protection in two halves and five practices
  • The asset inventory: what exists and who is accountable
  • The asset lifecycle: acquire, operate and maintain, retire
  • End of Life and end of support
  • Responding to an unsupported asset
  • Retiring an asset
  • Configuration baselines: the approved reference state
  • Hardening and documented exceptions
  • Change management: the controlled path for a change
  • Impact analysis and configuration dependencies
  • Approval authority versus administrator access
  • Testing and rollback planning
  • Emergency changes
  • Closing a change: validation and records
  • Configuration monitoring and drift

The five asset protection practices compared

AspectAsset inventoryLifecycle planningConfiguration baselineChange managementConfiguration monitoring
Outline topic5.4 Asset lifecycle management5.4 Asset lifecycle management5.4 Configuration and change management5.4 Configuration and change management5.4 Configuration and change management
Question it answersWhat do we have, and who is accountable for each asset?Where is the asset in its life, and is it still supported?What is the approved state of this system?Is this proposed change authorized and safe to make?Does the running system still match its approved state?
Typical triggerA purchase, a discovery finding or a security advisory to checkA buying decision, an End of Life notice or a retirementA new system build or an approved change to the baselineAny proposed alteration, including an emergency fixAn ongoing schedule or an automated alert
Main outputRecords with owner, location and software versionsSupport dates, a replacement plan and a controlled disposalDocumented settings plus approved exceptionsAn approved, tested and recorded change with a rollback planDrift findings reconciled with change records
Tempting wrong moveListing only the devices physically in the officeKeeping an unsupported asset because it still worksTreating the latest observed settings as approvedTreating administrator rights as approvalTrusting one passing check as permanent assurance

Decision tree

Which asset protection practice does the scenario call for?What exists, or who owns it?records, versions, discoveryAsset inventorycomplete, individual, currentYesNoSupport status or asset age?buying, EOL notice, retiringLifecycle planningacquire, operate and maintain, retireYesNoA system being altered?proposed or emergency changeChange managementanalyze, test, approve, validateYesNoDefining the approved state?new build, hardening, exceptionsConfiguration baselineapproved and hardened stateYesNoConfiguration monitoringcompare live settings, find drift
Cheat sheet

Cheat sheet

  • An asset inventory establishes what the organization must protect
  • Asset records need enough detail to identify and locate the responsible owner
  • A software inventory identifies which applications and versions are in use
  • Discovery results must be reconciled with the authorized asset inventory
  • AI workspace assets belong in normal asset protection processes
  • Product support lifetime is a security consideration when acquiring assets
  • Unsupported products can remain functional while becoming increasingly risky
  • Isolation and restricted access can reduce unsupported-system risk while replacement is arranged
  • Reimaging an obsolete system does not remove the vulnerability that remains unpatched
  • Asset retirement includes controlled disposition and inventory updates
  • End of Life identifies product retirement milestones that must be checked against support dates
  • A configuration baseline is an approved reference state
  • System hardening reduces unnecessary exposure while preserving required functions
  • Configuration drift is a departure from the approved baseline
  • Necessary deviations from a secure baseline must be documented and approved
  • Configuration records help show how a change can affect related components
  • Permission to administer a system is not automatically permission to approve its changes
  • Change review considers security effects as well as the desired business benefit
  • Testing a change before production helps reveal compatibility and security problems
  • A rollback plan provides a controlled way to reverse an unsuccessful change
  • Planned changes should be scheduled and communicated to affected stakeholders
  • Emergency changes use expedited controls rather than becoming undocumented exceptions
  • A change is completed by validating the result and updating controlled records

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.cisa.gov/resources-tools/resources/reducing-attack-surface-end-support-edge-devices
  2. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  3. https://www.ncsc.gov.uk/files/NCSC-Vendor-Security-Assessment.pdf
  4. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  5. https://csrc.nist.gov/glossary/term/asset
  6. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r4.pdf
  7. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  8. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-128.pdf
  9. https://www.cyber.gc.ca/en/guidance/obsolete-products-itsap00095
  10. https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices
  11. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf
  12. https://csrc.nist.gov/glossary/term/baseline_configuration
  13. https://csrc.nist.gov/glossary/term/configuration_item
  14. https://csrc.nist.gov/glossary/term/control_baseline
  15. https://csrc.nist.gov/glossary/term/hardening
  16. https://csrc.nist.gov/glossary/term/configuration_control
  17. https://csrc.nist.gov/glossary/term/security_impact_analysis
  18. https://csrc.nist.gov/glossary/term/configuration_control_board