1
00:00:06,600 --> 00:00:10,140
- Welcome to lesson 15, explain
the security implications

2
00:00:10,140 --> 00:00:14,280
of proper hardware, software,
and data asset management.

3
00:00:14,280 --> 00:00:16,800
Now, in our first lesson in lesson 15

4
00:00:16,800 --> 00:00:20,313
we're gonna be talking about
assets and asset management.

5
00:00:21,510 --> 00:00:25,380
Now, an asset is any
data, device or component

6
00:00:25,380 --> 00:00:28,050
that's of value to the organization.

7
00:00:28,050 --> 00:00:31,050
And every asset should
have an assigned owner

8
00:00:31,050 --> 00:00:32,700
and a custodian.

9
00:00:32,700 --> 00:00:35,190
Now, our owners are responsible
for decisions related

10
00:00:35,190 --> 00:00:37,350
to classification, and we
talked about that when we talked

11
00:00:37,350 --> 00:00:40,470
about classification and access control

12
00:00:40,470 --> 00:00:43,230
as well as oversight of
protection mechanisms.

13
00:00:43,230 --> 00:00:44,880
So the two key words when we're talking

14
00:00:44,880 --> 00:00:48,060
about owners are going to be decisions

15
00:00:48,060 --> 00:00:52,140
and oversight, decisions and oversight.

16
00:00:52,140 --> 00:00:54,120
Now, our custodians,
really what you and I do

17
00:00:54,120 --> 00:00:56,430
in our day-to-day jobs are responsible

18
00:00:56,430 --> 00:00:59,190
for the implementation, the management

19
00:00:59,190 --> 00:01:01,230
and the monitoring of controls.

20
00:01:01,230 --> 00:01:02,520
So we're the hands-on folks,

21
00:01:02,520 --> 00:01:05,100
we're doing the implementing,
managing and monitoring

22
00:01:05,100 --> 00:01:07,560
but we're also going to be advising owners

23
00:01:07,560 --> 00:01:10,170
on what controls they should put in place

24
00:01:10,170 --> 00:01:14,250
as well as educating owners
and our entire user community

25
00:01:14,250 --> 00:01:16,383
about the controls and how to use them.

26
00:01:18,150 --> 00:01:20,223
So let's talk about asset management.

27
00:01:21,090 --> 00:01:24,570
Asset management is a set
of activities that focus

28
00:01:24,570 --> 00:01:27,990
on the acquisition, the
management, and the accounting.

29
00:01:27,990 --> 00:01:29,640
Where are they, who has them?

30
00:01:29,640 --> 00:01:33,060
What's the end of life of assets inclusive

31
00:01:33,060 --> 00:01:36,033
of inventory management
and classification?

32
00:01:37,590 --> 00:01:40,050
Now, a sub component or
a supporting component

33
00:01:40,050 --> 00:01:43,020
of asset management is going
to be inventory management.

34
00:01:43,020 --> 00:01:45,600
And that's gonna be our
policies, our standards

35
00:01:45,600 --> 00:01:48,690
and our procedures to track and maintain

36
00:01:48,690 --> 00:01:50,940
and replace our assets.

37
00:01:50,940 --> 00:01:54,180
And of course, classification ties closely

38
00:01:54,180 --> 00:01:56,730
into asset management
because that's the process

39
00:01:56,730 --> 00:01:59,670
of organizing our assets by criticality.

40
00:01:59,670 --> 00:02:01,770
We said that physical
and infrastructure assets

41
00:02:01,770 --> 00:02:05,460
are very often organized
by operational criticality

42
00:02:05,460 --> 00:02:06,540
and/or sensitivity.

43
00:02:06,540 --> 00:02:09,450
And usually our data is
organized by sensitivity.

44
00:02:09,450 --> 00:02:12,200
And we covered that in our
whole classification lesson.

45
00:02:14,520 --> 00:02:17,100
So what are some tools
that we can use to really

46
00:02:17,100 --> 00:02:19,770
get a good handle on our inventory?

47
00:02:19,770 --> 00:02:21,750
While we have network mapping tools,

48
00:02:21,750 --> 00:02:25,833
network enumeration tools,
and software auditing tools.

49
00:02:25,833 --> 00:02:28,290
Now, network mapping tools are used

50
00:02:28,290 --> 00:02:31,800
to create physical and logical diagrams.

51
00:02:31,800 --> 00:02:33,690
Now, some popular network mapping tools

52
00:02:33,690 --> 00:02:35,887
include SolarWinds and Spiceworks

53
00:02:35,887 --> 00:02:38,883
and ManageEngine and Nmap.

54
00:02:39,750 --> 00:02:43,470
Network enumeration tools
are used to actually discover

55
00:02:43,470 --> 00:02:47,460
and document devices as well
as their characteristics.

56
00:02:47,460 --> 00:02:51,867
Popular enumeration tools
include DumpSec and Nessus.

57
00:02:51,867 --> 00:02:54,480
And then software audits
tools are designed

58
00:02:54,480 --> 00:02:58,080
to track licensed and unlicensed software.

59
00:02:58,080 --> 00:03:00,360
Part of our compliance
requirements, and really part

60
00:03:00,360 --> 00:03:02,520
of just being a good human being, right,

61
00:03:02,520 --> 00:03:04,770
is to honor software licenses,

62
00:03:04,770 --> 00:03:06,960
to not be using unlicensed software

63
00:03:06,960 --> 00:03:09,063
which really is just illegal as well.

64
00:03:10,740 --> 00:03:14,850
So every asset should have
a lifecycle management plan.

65
00:03:14,850 --> 00:03:17,640
Now, lifecycle management
plan covers all aspects

66
00:03:17,640 --> 00:03:20,910
of the product lifecycle
from the day we acquire it

67
00:03:20,910 --> 00:03:22,380
all the way to its end date.

68
00:03:22,380 --> 00:03:25,770
And we always wanna be
preparing for that end date

69
00:03:25,770 --> 00:03:28,800
because preparation for end
date mitigates the risks

70
00:03:28,800 --> 00:03:31,530
of serious vulnerabilities
associated with end of life

71
00:03:31,530 --> 00:03:36,530
and end of support and unexpected
or unnecessary downtime.

72
00:03:36,715 --> 00:03:39,204
So what are those asset end dates?

73
00:03:39,204 --> 00:03:41,520
Well, we have the notification date.

74
00:03:41,520 --> 00:03:42,780
That's number one.

75
00:03:42,780 --> 00:03:45,300
We have the last sale date, number two.

76
00:03:45,300 --> 00:03:47,910
We have an end of life date, number three.

77
00:03:47,910 --> 00:03:51,600
And we have end of support,
which is number four.

78
00:03:51,600 --> 00:03:54,450
So let's talk about those
end of date milestones.

79
00:03:54,450 --> 00:03:59,450
Notification, end of sale, end
of life, and end of support.

80
00:03:59,490 --> 00:04:02,730
The notification date is a
date when the end of sale,

81
00:04:02,730 --> 00:04:06,300
end of life and end of support
milestones for a product,

82
00:04:06,300 --> 00:04:09,360
for a service or subscription
is going to be communicated

83
00:04:09,360 --> 00:04:10,800
to the general public.

84
00:04:10,800 --> 00:04:12,990
Now, for some publishers or manufacturers

85
00:04:12,990 --> 00:04:15,870
they do that right on the
date of the product release.

86
00:04:15,870 --> 00:04:18,300
Others may not be so
sure and so you'll have

87
00:04:18,300 --> 00:04:19,830
to sort of stay in touch with them

88
00:04:19,830 --> 00:04:22,353
to find out what those
dates are going to be.

89
00:04:23,460 --> 00:04:26,400
Now, the end of sale date
is a date when the product

90
00:04:26,400 --> 00:04:30,120
or service or subscription is
no longer available for sale.

91
00:04:30,120 --> 00:04:31,755
You can't buy it anymore.

92
00:04:31,755 --> 00:04:35,010
The end of life date, which
we talked about before

93
00:04:35,010 --> 00:04:38,340
is the date when a product
or subscription or service

94
00:04:38,340 --> 00:04:40,170
is determined to be obsolete.

95
00:04:40,170 --> 00:04:43,410
And once obsolete, the
product or subscription

96
00:04:43,410 --> 00:04:48,180
is not going to be sold,
maintained, or improved.

97
00:04:48,180 --> 00:04:51,060
That means there's no more
features, no new functionality,

98
00:04:51,060 --> 00:04:52,803
it's not improved at all.

99
00:04:53,730 --> 00:04:56,250
And then we get to that
end of support date

100
00:04:56,250 --> 00:04:58,920
which is the last date
to receive applicable

101
00:04:58,920 --> 00:05:00,030
service and support.

102
00:05:00,030 --> 00:05:02,220
Now, that's bad, right?

103
00:05:02,220 --> 00:05:04,200
If we don't wanna be
running anything past then

104
00:05:04,200 --> 00:05:06,300
we won't get any more service and support.

105
00:05:06,300 --> 00:05:09,840
And really critical
here is after this date,

106
00:05:09,840 --> 00:05:11,583
updates are no longer available.

107
00:05:14,220 --> 00:05:17,670
Most vendors have very clear policies

108
00:05:17,670 --> 00:05:19,950
about the lifecycle of their products.

109
00:05:19,950 --> 00:05:23,250
Those vendor lifecycle
policies establish predictable

110
00:05:23,250 --> 00:05:28,080
guidelines for product support
and servicing timetables.

111
00:05:28,080 --> 00:05:30,000
Now, they may have either a fixed

112
00:05:30,000 --> 00:05:31,620
or what's known as a continuous,

113
00:05:31,620 --> 00:05:34,380
sometimes referred to
as a modern, lifecycle.

114
00:05:34,380 --> 00:05:36,240
A fixed lifecycle is products

115
00:05:36,240 --> 00:05:39,550
with a defined date at
the time of release.

116
00:05:39,550 --> 00:05:42,240
But more and more we're
seeing this continuous

117
00:05:42,240 --> 00:05:44,850
or modern lifecycle and these are products

118
00:05:44,850 --> 00:05:47,640
with continuous support and servicing.

119
00:05:47,640 --> 00:05:51,660
But the key is that customers
must take the latest update

120
00:05:51,660 --> 00:05:53,133
to remain supported.

121
00:05:55,980 --> 00:05:58,020
We're gonna, one more
time, we're gonna talk

122
00:05:58,020 --> 00:06:01,110
about our end of life
and end of support risks.

123
00:06:01,110 --> 00:06:03,720
Whenever possible,
right, it's so important

124
00:06:03,720 --> 00:06:04,890
that our hardware and software

125
00:06:04,890 --> 00:06:07,260
should be refreshed prior to end of life

126
00:06:07,260 --> 00:06:09,630
'cause we'll have no more
features or functionalities

127
00:06:09,630 --> 00:06:12,510
and definitely before
end of support, well,

128
00:06:12,510 --> 00:06:15,300
because we're not gonna
have any support, any help

129
00:06:15,300 --> 00:06:16,983
and we won't have any patches.

130
00:06:17,940 --> 00:06:20,550
Just a reminder that our
adversaries will continue

131
00:06:20,550 --> 00:06:23,580
to identify and exploit vulnerabilities,

132
00:06:23,580 --> 00:06:25,800
that almost every regulation requires

133
00:06:25,800 --> 00:06:29,400
that organizations take reasonable
steps to protect the data

134
00:06:29,400 --> 00:06:31,170
and systems under its control.

135
00:06:31,170 --> 00:06:34,860
And not doing so can be
considered a compliance violation.

136
00:06:34,860 --> 00:06:37,530
So having end of life or
end of support products

137
00:06:37,530 --> 00:06:40,050
or services or subscriptions
would definitely

138
00:06:40,050 --> 00:06:43,290
not be considered a
reasonable step, right?

139
00:06:43,290 --> 00:06:46,230
The reasonable step
would be to refresh them.

140
00:06:46,230 --> 00:06:47,820
Now, you could have exposure to litigation

141
00:06:47,820 --> 00:06:50,520
for not upholding the
standard of due care.

142
00:06:50,520 --> 00:06:51,600
Due care is the standard

143
00:06:51,600 --> 00:06:53,790
that a reasonable person would follow.

144
00:06:53,790 --> 00:06:56,850
You have risk of downtime
due to lack of support

145
00:06:56,850 --> 00:06:58,290
and service resolution.

146
00:06:58,290 --> 00:07:01,200
And you probably will have incompatibility

147
00:07:01,200 --> 00:07:06,200
with newer operating systems,
applications and hardware.

148
00:07:06,240 --> 00:07:08,610
So I know we've talked
about this a number of times

149
00:07:08,610 --> 00:07:10,920
but I do expect this
to come up on your exam

150
00:07:10,920 --> 00:07:13,740
and it will definitely
come up in real life

151
00:07:13,740 --> 00:07:15,483
in your day-to-day practice.

152
00:07:16,646 --> 00:07:19,233
And with that, we have a
three second challenge.

153
00:07:20,520 --> 00:07:23,130
Challenge one, the date
when a product, service

154
00:07:23,130 --> 00:07:26,400
or subscription is
determined to be obsolete.

155
00:07:26,400 --> 00:07:28,293
1, 2, 3.

156
00:07:29,640 --> 00:07:31,040
That's gonna be end of life.

157
00:07:32,250 --> 00:07:35,490
Number two, the lifecycle
policy for products

158
00:07:35,490 --> 00:07:39,093
with a defined end of support
date at the time of release.

159
00:07:40,650 --> 00:07:43,080
1, 2, 3.

160
00:07:43,080 --> 00:07:45,033
That's gonna be a fixed lifecycle.

161
00:07:46,920 --> 00:07:50,550
Number three, after this
date updates are available

162
00:07:50,550 --> 00:07:52,500
by exception only.

163
00:07:52,500 --> 00:07:54,210
Hmm, we didn't really talk about this

164
00:07:54,210 --> 00:07:56,760
but take your answer and
then we'll talk about it.

165
00:07:56,760 --> 00:07:59,400
1, 2, 3.

166
00:07:59,400 --> 00:08:00,750
That's end of support.

167
00:08:00,750 --> 00:08:04,740
So at the end of the support
time updates aren't available

168
00:08:04,740 --> 00:08:07,380
but sometimes, sometimes
there are exceptions.

169
00:08:07,380 --> 00:08:09,823
And Microsoft has been notable with this.

170
00:08:09,823 --> 00:08:13,080
Some of their Windows products
that are way outta date

171
00:08:13,080 --> 00:08:15,000
are still being used worldwide.

172
00:08:15,000 --> 00:08:18,240
And every once in a while
when there's a really,

173
00:08:18,240 --> 00:08:22,320
really critical vulnerability,
they will actually reach back

174
00:08:22,320 --> 00:08:25,500
and release a patch for
that critical vulnerability.

175
00:08:25,500 --> 00:08:28,113
But it's definitely,
definitely by exception only.

176
00:08:29,707 --> 00:08:31,230
Number four.

177
00:08:31,230 --> 00:08:35,370
The tool used to create
physical and logical diagrams.

178
00:08:35,370 --> 00:08:37,263
1, 2, 3.

179
00:08:38,130 --> 00:08:39,633
That's a network mapping tool.

180
00:08:41,220 --> 00:08:44,730
And number five, the
process of organizing assets

181
00:08:44,730 --> 00:08:47,463
by criticality and or sensitivity.

182
00:08:48,660 --> 00:08:50,253
1, 2, 3.

183
00:08:51,360 --> 00:08:52,953
And that's classification.

184
00:08:53,990 --> 00:08:56,130
That brings us to a security-in-action

185
00:08:56,130 --> 00:08:57,960
so we can practically apply our knowledge.

186
00:08:57,960 --> 00:09:00,810
And this one's about asset management.

187
00:09:00,810 --> 00:09:03,690
Now, one of the findings
of a recent IT audit is

188
00:09:03,690 --> 00:09:07,770
that there is no inventory of IT assets.

189
00:09:07,770 --> 00:09:11,130
When this finding is presented
at the audit exit meeting,

190
00:09:11,130 --> 00:09:14,940
the IT manager defiantly
responds that "we're a small

191
00:09:14,940 --> 00:09:19,050
company and my team is well
aware of what the company owns."

192
00:09:19,050 --> 00:09:20,490
Okay, what's your response?

193
00:09:20,490 --> 00:09:22,950
You're sitting there, what do you say?

194
00:09:22,950 --> 00:09:24,540
So just a a quick recap.

195
00:09:24,540 --> 00:09:27,090
We just had this recent IT audit.

196
00:09:27,090 --> 00:09:31,613
There was no inventory of IT assets.

197
00:09:31,613 --> 00:09:34,680
Findings presented at
the audit exit interview

198
00:09:34,680 --> 00:09:37,170
and boy, the IT manager doesn't like that.

199
00:09:37,170 --> 00:09:38,880
He's like, yeah, well,
we know what we have

200
00:09:38,880 --> 00:09:41,310
so we don't need to
have an asset inventory.

201
00:09:41,310 --> 00:09:42,143
Do you agree?

202
00:09:42,143 --> 00:09:43,170
What do you think?

203
00:09:43,170 --> 00:09:45,240
Go ahead and put me on pause.

204
00:09:45,240 --> 00:09:46,680
Think about this one for a sec and

205
00:09:46,680 --> 00:09:48,280
come on back with your response.

206
00:09:50,730 --> 00:09:52,991
Well, very succinctly, you can't protect

207
00:09:52,991 --> 00:09:55,920
what you don't know you have.

208
00:09:55,920 --> 00:09:56,753
Let's say that again.

209
00:09:56,753 --> 00:10:00,960
You can't protect what
you don't know you have.

210
00:10:00,960 --> 00:10:03,750
Inventory management is
really the foundation

211
00:10:03,750 --> 00:10:05,970
of vulnerability and patch management.

212
00:10:05,970 --> 00:10:07,590
How can we have vulnerability

213
00:10:07,590 --> 00:10:10,440
and patch management work appropriately

214
00:10:10,440 --> 00:10:13,170
if we don't even know
what we're protecting?

215
00:10:13,170 --> 00:10:15,630
So inventory management is also critical

216
00:10:15,630 --> 00:10:18,180
for tracking equipment
and for facilitating

217
00:10:18,180 --> 00:10:20,790
recovery of lost or stolen assets

218
00:10:20,790 --> 00:10:23,640
as well as end of life replacements.

219
00:10:23,640 --> 00:10:24,960
We need to have the inventory,

220
00:10:24,960 --> 00:10:27,810
we need to know end of life
dates, end of support dates,

221
00:10:27,810 --> 00:10:30,330
that allows us to create
our refresh policies.

222
00:10:30,330 --> 00:10:31,830
Again, if we don't know what we have,

223
00:10:31,830 --> 00:10:33,543
we can't do any of that.

224
00:10:34,860 --> 00:10:38,550
And software asset management
is really necessary

225
00:10:38,550 --> 00:10:40,110
for license compliance.

226
00:10:40,110 --> 00:10:41,700
Again, if we don't know what we have,

227
00:10:41,700 --> 00:10:45,000
how do we know that we're in
compliance with our licenses?

228
00:10:45,000 --> 00:10:47,940
So the IT manager is
probably very talented

229
00:10:47,940 --> 00:10:51,780
at what he or she does,
but it's really important

230
00:10:51,780 --> 00:10:53,280
from an organizational perspective,

231
00:10:53,280 --> 00:10:55,170
a risk management perspective, right,

232
00:10:55,170 --> 00:10:58,920
that we have an accurate
inventory of our assets

233
00:10:58,920 --> 00:11:01,350
and those assets should
have owners and custodians.

234
00:11:01,350 --> 00:11:02,580
Those assets should be included

235
00:11:02,580 --> 00:11:04,920
in our vulnerability and patch management.

236
00:11:04,920 --> 00:11:07,620
We should, and as well
as in our refresh policy

237
00:11:07,620 --> 00:11:09,240
so that we don't reach, you know,

238
00:11:09,240 --> 00:11:11,520
end of life or end of support dates.

239
00:11:11,520 --> 00:11:14,430
And of course to ensure
that we are in compliance

240
00:11:14,430 --> 00:11:16,530
with all licensing requirements.

241
00:11:16,530 --> 00:11:19,173
And doing that, my friends,
is security in action.

242
00:11:20,070 --> 00:11:21,960
That brings you to your word map.

243
00:11:21,960 --> 00:11:22,793
You know what to do.

244
00:11:22,793 --> 00:11:24,900
Make sure you're all really comfortable

245
00:11:24,900 --> 00:11:27,660
and confident in every one of these terms.

246
00:11:27,660 --> 00:11:29,580
And when you're ready, head
on over to the next lesson.

247
00:11:29,580 --> 00:11:31,080
I'll be waiting for you there.