CoreQ Academy4.2 Explain the security implications of proper hardware, software, and data asset management.
You cannot secure what you do not know you have. Asset management tracks every device, application and dataset from purchase to destruction.
Acquisition and assignment
- Acquisition/procurement process
- Buying through approved channels and vendors, with security requirements checked before purchase.
- Ownership
- Every asset has a named owner accountable for it.
- Classification
- Assets labelled by sensitivity and criticality to set protection levels.
Monitoring/asset tracking
- Inventory
- An accurate list of assets: what, where, who owns it, software version.
- Enumeration
- Actively discovering assets on the network (scans, agents) to find unknown or rogue devices.
Disposal/decommissioning
- Sanitization
- Removing data so it cannot be recovered: overwriting, cryptographic erase, degaussing (magnetic media).
- Destruction
- Physically destroying media: shredding, pulverising, incinerating. Used when media will not be reused.
- Certification
- Documented proof (certificate of destruction) that sanitisation or destruction was done, often from a third party.
- Data retention
- Keeping data only as long as required by law or business need, then disposing of it securely.
Check your understanding
Knowledge quiz · pass mark 80%
- Scanning the network to discover devices not in the CMDB is:
- Keeping all data forever is the safest retention strategy.
- Which document proves a vendor destroyed your old drives?
Original CoreQ Academy material, mapped to objective 4.2 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.