Asset Management: Ensures all devices (software and hardware) are identified, catalogued, and monitored.
Change Management: All modifications to systems are controlled and secure.
Acquisition and Procurement
Acquisition: Process of obtaining goods.
Procurement: Encompasses full process of acquiring goods and services (includes previous steps).
The approval process for purchases ensures alignment with company’s goals and needs; unique to each organization.
Ways to Buy
Company credit card: Useful for small, fast transactions (e.g., ink and toner).
Individual purchase: Employees buy on company’s behalf and later seeks reimbursement from their employer.
Purchase orders (PO): Formal document that authorizes a specific purchase for larger/more expensive items.
Mobile Device Deployments
Bring Your Own Device (BYOD): Employees can use personal devices for work. Very convenient for the employee and less expensive for employer. But employees own and control the security of their own devices. You cannot add a personal device to MDM or enforce stricter security configurations.
Corporate-Owned, Personally Enabled (COPE): Company provides mobile device to employees for work and personal use. High-cost for employer.
Choose Your Own Device (CYOD): Employees choose devices from a company-approved list. A middle-ground between BYOD and COPE. High-cost for employer, and employee data privacy concerns.
Asset Management
Systematic approach to governing and maximizing value of items an entity is responsible for throughout their lifecycle.
Assignment/Accounting
Every asset is owned by an individual/group. There should be no ambiguity about who owns what.
Classification: Categorizing assets based on function, value, or other relevant parameters.
Monitoring/Tracking
Ensures proper accountability and optimal use of each asset.
Asset Tracking: Involves maintain comprehensive inventory with asset specifications, locations, assigned users, and relevant details.
Enumeration: Involves identifying and counting assets during times of asset procurement or retirement. Used in especially large organizations.
Mobile Device Management (MDM): Lets organizations securely oversee employee devices, ensuring policy enforcement, software consistency and data protection. Centralization boosts security by ensuring all devices comply with latest standards and protocols. Lets IT remotely lock and wipe devices, mass-update/install applications, etc.
Asset Disposal
Special Publication 800-8, “Guidelines for Media Sanitization”
Sanitization
Process of making data inaccessible and irretrievable from a storage medium using traditional forensic methods.
Overwriting: Replacing existing data with random bits of information to ensure original data is obscured.
Degaussing: Degausser produces strong magnetic field that can disrupt magnetic domains on storage devices like HDDs or tapes. Device loses its data storage capability. Used when devices are being recycled/disposed.
Secure Erase: Completely deletes data from a storage device while ensuring that it cannot be recovered using traditional recovery tools. Now replaced by Cryptographic Erase.
Cryptographic Erase: Rather than erase the data, we just delete the encryption keys for a device. Very fast, especially for massive drives. Allows device to be trashed or resold.
Destruction: Ensures physical device is beyond recovery or reuse (e.g., shredding, pulverizing, melting, incinerating).
Certification
Act of proof that data or hardware has been securely disposed of. Organizations should prioritize data security by documenting sanitization, disposal, or destruction of data.
Data Retention
Data retention is focused on strategically deciding what to keep and for how long. Regulations may require specific data to be retained for a set duration. The more you store, the more you must secure.
Change Management
Organizations orchestrated strategy to transition existing state for a more desirable future state.
Change Advisory Board (CAB): Body of representatives from various parts of an organization who are responsible for evaluating proposed changes.
Change Owner: Individual or team that initiates the change request.
Stakeholders
Stakeholder: Person who has a vested interest in the proposed change. You must inform/plan for your Technical Stakeholders, Business Stakeholders, and End-User Stakeholders.
Impact Management
What could go wrong?
What would be the immediate effects?
How would long-term operations be impacted?
Are there unforeseen challenges that might cause an issue?
Change Management Processes
Five steps:
Preparation: Assessing the current state and recognizing the need for transition. Gather necessary resources, engage stakeholders, ensure preparedness.
Vision for Change: Clear, compelling description of the desired future state that explains reasons and ensures vivid vision.
Implementation: Put plan into action (Training, Restructuring teams, Introducing new technologies, Continuously communicate with stakeholder).
Downtime: Estimate potential downtime against benefits.
Service and Application Restarts: Many changes require restarts, which can be disruptive when applied. Data may be lost in transit.
Legacy Application: Older software or system that is still being used. Can malfunction or crash from even minor updates in other parts of the system.
Dependencies: Map existing dependencies before making changes.
Documenting Changes
What was done, when was it done, and why?
Version Control
Tracks and manage changes in documents and software, enabling collaborative work and rollbacks. Preserves history and ensures continuity and stability.
Proper Documentation
Properly document and record every change.
Update diagrams.
When encountering implementation issues, revise policies and procedures to prevent future occurrences.
Update related change request or trouble ticket to indicate completion. This provides the audit log for the change.