this guide will help you understand in detail who the Asset Management module works and relates to other modules.

Transcription

1 Asset Management Introduction this guide will help you understand in detail who the Asset Management module works and relates to other modules. this module is critical for most of you looking forward the creation of a security program and in particular something on the grounds of ISO or NIST this module will help you with: identify assets with the end purpose of risk analysis define your own asset classification create data flows (what happens when data at each stage: creation, modification, deletion, etc) asset labelling (define labels for data assets) WARNING: this is not an inventory module. asset management in the scope of security is understood as the initial analysis to identify risks. Asset Identification Introduction identifying and analysing (and as part of that analysis, classifying them) assets in the scope of a security program is a basic exercise and if done properly, extremely useful. eramba will help you systematically identify assets for each of the previously defined business units. the benefit of doing it this way is that you ensure that all assets in use by each business unit in scope are addressed. the proper identification of assets will be crucial to see real business benefits during Risk Management of Data Flow Analysis.

2 As you see in the image above, the asset in red has been identified (and all it s attributes underneath) and mapped with two business units. risks associated with this assets will be linked in the future (shown in the image on the left) Back to the top Using the module this is an important part of the system as it will enable you to perform many other interesting things such as risk analysis and data flow analysis. unless you work with a massively huge organisation such as toyota or shell, you should not have more than a hundred assets. remember, this is not an inventory exercise. the whole objective of identifying assets is to feed the Risk Process (and the incident module). the way we prefer working on this is leveraging from previous conversations (talks, not questionnaires, etc) with business units where they tell me what they do, how and with what elements (assets!). the what is what we need in this section. for each business unit, stakeholders need to

3 walk you trough every main process they run and you need to get the assets they use. For example: you might find that Human Resources and Finance, both have laptops. they might have different characteristics (brand, etc) but you should not care for that. they are laptops and that is an asset. one asset, not two. for each asset make sure you map their related business unit, in the previous example the asset laptop would have mapped the BUs Finance and Human Resources, their liabilities (as this will make the trick when risk analysing) and their asset type (as this will let you run data asset analysis). the other fields (owner, guardian, user, classification, labels, etc) are mostly for those under ISO reviews when creating an asset, you will be asked to provide a Review date. this date will be used to keep a log of the scheduled reviews for this asset. usually this is every 12 months or so and the whole point is to ensure the asset information (classification, owner, etc) is still accurate. every time the value Review is modified a new entry on the review menu will be created. so when looking at the reviews under the manage option you will presented with a popup that lists them all.

4 you typically edit a review and complete the description, reviewer and completed fields (if the review has been completed or not). you may also attach evidence that the review has been conducted (such an to the owner of the asset). you may also create a review before the scheduled date (for example if something changed on the organisation and all assets were reviewed). reviews will be stored and included as part of the PDF export of an asset. when a review has not been Completed on time, the asset will be displayed with a status alarm Asset with missing reviews. notifications notifications can be defined in the asset module, on top of the typical default notifications you have specific notifications for reviews where you will be ed 10 days ahead of a review deadline. Asset Classification

5 Introduction ISO and other standards put a lot of stress into classifying assets according to some organisational criteria, for example something around their integrity, confidentiality or availability. Once you define your classification you will be able to apply it to every asset you later identify. the following is an example of asset classification used in a ISO program Using the module asset classification is in my opinion not really useful unless you are working with risk management in the eyes of ISO ISO requires you to build a classification and apply it on the assets. for that purpose you can build here your own classification criteria. my suggestion is to do what ISO auditors are used to see that is a classification based on the asset confidentiality, integrity and availability. the one i personally choose is for each of them: high: anything related to the integrity,confidentiality or availability that could bring legal issues medium: anything related to the integrity,confidentiality or availability that could bring reputation issues low: anything related to the integrity,confidentiality or availability that could bring minor issues dont forget, you should state in your security policy what your asset classification is!

6 Asset Labels Introduction once again, labelling assets is a common requirement in most standards related to security, including ISO labels are one way of profiling data, typical examples are Private, Confidential, Public Domain, etc. labels defined in this section will later be associated with every identified asset. the following is a simple labelling example: Using the module although i do see a little bit of value in terms of security, once again, this is a requirements from ISO. you should define this in a security policy and simply map what you have there in eramba. an example is: restricted: The asset must be of considerable sensibility or confidentiality or integrity. This decision is up to the asset owner and assistance when required of the Legal department internal: The asset must be of considerable sensibility or confidentiality or integrity as the Restricted tag but the audience, instead of being restricted to certain teams or individuals is restricted to the corporation as a whole. public: Anyone is a valid, potential recipient Asset Types

7 Introduction on top of the list of default asset types, the user is allowed to create more to match their needs. simply create a new type and it will become available to use in the system. Data Asset Analysis Introduction most security people is concerned that confidential data (credit-card numbers, credential, secrets, trade marks, etc) remains undisclosed but few really spend the time to understand what happens when data is created, modified, deleted, discarded, etc and were the risks really exists. data flows will let users to perform the analysis of what happens with data and map for each state which security controls are available to protect it. on the image above states are defined as columns (created, transit, etc) and controls in green.

8 if done properly, this analysis goes to the point (risk analysis applied to asset) and avoids getting into other complicated practices such as risk management. this exercise is highly recommended for those who are tempted to spend zillion dollars in data loss prevention solutions (DLP, Network DLP, Etc). Back to the top Using the module if you dont need to run a risk management program (say because you are not under ISO, etc) we would definitely recommend you focusing on this section as it s easier to maintain and goes into the point of understanding what is your critical data and what it takes to look after it. Warning: to use this sub-module you will need to have compiled your list of controls (Security Controls / Security Services). the objective is for every asset previously identified as Data Asset describe for every state (created, transmitted, modified, etc) who uses the data, with whom (third parties) and what controls (or not) are there to safeguard data. this is a simple approach to risk management but one that hits the bell as in the end, your security program is there in part, to protect critical data. you need to conduct interviews with the stakeholders of each business unit that originally notified you about the data asset and ask what happens for each of the following stages: created (when the data is created, for example when invoices paper arrive to the company) stored (when the invoices are stored in lockers or scanned and stored in a share drive) deleted (when the papers are deleted) modified (paper invoices cant be modified, you could review if integrity could be questioned) transit (when the invoices are shared with someone else) unnecessary (when invoices become not useful) for each of the stages, you need to validate:

9 which business unit is in contact with the data asset which external third party is involved (to further analyse third parties) what controls exist to protect the data from risk what projects can be implemented in case there are no controls where they should once the analysis is done, the status field will keep you aware trough out the changes of states of controls and projects if the analysis remains relevant or not (controls expired, failed audits, etc) you can export the data to a CSV if you want to have a deeper look or share your analysis with your colleagues.