Chapter 7. Identifying Assets and Activities to Be Protected

Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure Seven domains of a typical IT infrastructure are: User Domain Workstation Domain LAN Domain LAN-to-WAN Domain WAN Domain Remote Access Domain System/Application Domain

Group work With your partner discuss Seven Domains of a Typical IT Infrastructure

Seven domains of a typical IT infrastructure

For each of the seven domains, consider the assets you have and ask yourself some basic questions: Are the assets valuable to the organization? Are they included in any type of inventory or asset management system?

Inventory and asset management There is a difference between inventory management and asset management. Inventory management This is used to manage hardware inventories. It includes only the basic data, such as model and serial numbers. It shows : what assets are on hand, where they're located, and who owns them. Inventory management is valuable to ensure that the inventory isn't easily lost or stolen.

Inventory and asset management This is used to manage all types of assets. It includes much more detailed data than an inventory management system includes. For example, asset management would cover installed components, hardware peripherals, installed software, update versions, and more.

User domain The User Domain includes people or employees. An HR department maintains records on employees. These can be manual records, such as folders held in filing cabinets, or files held on servers. Data on users includes: Personal and contact data Employee reviews Salary and bonus data Health care choices A significant concern with asset management in the User Domain is confidentiality. Data must be protected against unauthorized disclosure

Workstation Domain The Workstation Domain includes the PCs used by employees. It could include typical desktop PCs. It could also include mobile computers or laptops. Assets in the Workstation Domain have two risks to address: Theft An organization has a significant investment in these systems. It can't afford to allow them to disappear. Inventory management systems include processes where each item is manually located on a periodic basis. This verifies the system is still in the organization's control. Updates As updates, fixes, and patches are released, they need to be applied to the systems. If the systems are not updated, they become vulnerable to new exploits. Use automated asset management systems to keep systems up to date. An automated system will often perform three steps: 1) inspect systems for current updates, 2) apply updates, and 3) verify the updates.

LAN domain The LAN Domain includes all the elements used to connect systems and servers together. The local area network (LAN) is internal to the organization. The primary hardware components are hubs, switches, and routers.

LAN domain It's important to have a basic inventory of these devices. This includes the basics such as model, serial number, and location. Although any network device includes firmware, the more functional network devices such as routers and switches have a built-in operating system (OS). The version of the OS determines its capabilities, so it's often useful to include the version in the inventory.

LAN-to-WAN Domain The LAN-to-WAN Domain is the area where your internal LAN connects to the wide area network (WAN). In this context, the WAN is often the Internet. The primary devices you're concerned with here are the firewalls. You can have a single firewall separating the LAN from the WAN. You can also have multiple firewalls to create a demilitarized zone (DMZ) or a buffer area.

LAN-to-WAN Domain You'll want to include the following information in an asset management system: Hardware information This includes basics, such as the model and serial number. If the model supports different add-ins, such as additional memory, or additional network interface cards, you'll want to include these. Configuration data A significant amount of time goes into creating a firewall policy. You then create firewall rules and exceptions to implement the policy. At the very least, all these rules and exceptions need to be documented. Whenever possible, you should create scripts to automate the process. You should then back up these scripts.

WAN Domain The WAN Domain includes any servers that have direct access to the Internet. This includes any server that has a public Internet Protocol (IP) address

WAN Domain Inventory and asset management information for WAN- based servers include: Hardware information This information includes basics, such as the model and serial number. Documentation is similar to how you'd document servers in the LAN-to-WAN Domain. Update information Servers in the WAN need to be kept up to date. This is an important step to ensure the server stays secure.

Remote Access Domain Remote access technologies give users access to an internal network via an external location. This can be done via direct dial-up or virtual private network (VPN). When dial-up is used, clients and servers have modems and access to phone lines. When a VPN is used, the VPN server has a public IP address available on the Internet. Clients access the Internet, and then use tunnelling protocols to access the VPN server.

Remote Access Domain Inventory and asset management information needed for servers in the Remote Access Domain are similar to those in the WAN Domain

System/Application Domain The System/Application Domain includes servers used to host server applications. Some examples of different types of application servers include: E-mail servers—This can be a single e-mail server. It can also be a larger e-mail solution, including both front- end and back-end server configurations. Database servers—This can be an Oracle or Microsoft SQL server. It can be a single server or a group of servers. Web servers Web servers host Web sites and serve them to Web clients. A single Web server can host a single Web site or hundreds of Web sites.

System/Application Domain Inventory and asset management systems should include the following information on any servers in the System/Application Domain: Hardware information—This includes basics such as the model and serial number, just as you'd inventory a workstation. It should also include an inventory of the hardware components. Update information—Servers need to be kept up to date. This is especially true if any of these servers are public-facing servers, such as Web servers and some e- mail servers.