4.2 Asset management explained

You can't protect what you don't know you have. Objective 4.2 covers the whole life of an asset, hardware, software or data, and the security decisions at each stage.

It starts with acquisition and procurement. Buying through an approved process means security can check the supplier and the product before it enters the environment, and it gives you a record that the asset exists. Assignment and accounting come next. Every asset should have an owner who is accountable for it, and a classification that says how sensitive it is and therefore how it must be handled.

Monitoring and asset tracking keep the picture current. An inventory lists what you own. Enumeration is the act of discovering what is actually present, for example by scanning the network, and comparing it to the inventory. Devices that appear in a scan but not in the inventory are unmanaged and probably unpatched, so finding them is a security win in itself.

Disposal and decommissioning is where most exam questions sit. Sanitization removes data so it can't be recovered, while leaving the media usable. Overwriting works for traditional hard drives that still function. Degaussing uses a strong magnetic field to erase magnetic media, and leaves the drive unusable. Cryptographic erase destroys the encryption key of a self-encrypting drive, which makes the data unreadable almost instantly and suits solid state drives, where overwriting is unreliable. Destruction physically shreds, crushes or burns the media when it must never be reused.

Certification is the evidence. When a third party destroys drives, the organisation should get a certificate of destruction recording what was destroyed, when and how. That certificate is what an auditor will ask for.

Data retention is the final piece. A retention policy says how long each type of data must be kept, often driven by regulation, and when it must be securely destroyed. Keeping data longer than required increases the damage of a breach and the cost of legal discovery, while deleting it too early can break the law.

Questions in this area are usually precise about the media and its condition. A failed magnetic drive that won't power up can't be overwritten, so degaussing or destruction is the answer. A retired SSD with built-in encryption points to cryptographic erase.