4.2.3 Monitoring & Asset Tracking

Monitoring and asset tracking involves the continuous identification, inventory, and valuation of organizational resources to manage risk and ensure operational availability.

Asset Identification and Valuation Security professionals must distinguish between different types of assets to determine appropriate protection levels. - Tangible Assets: Physical items with measurable costs, such as gateways, routers, and servers. - Intangible Assets: Non-physical items that are difficult to quantify, such as reputation, brand recognition, and customer goodwill. - Asset Value (AV): The total monetary worth of an asset, including original purchase price, replacement cost, repair cost, and any depreciation over time. - Revenue Impact: Valuation must include the secondary costs of an asset being offline, such as lost income during the time it takes a vendor to deliver a replacement.

Quantitative Risk Metrics Calculating potential loss allows organizations to prioritize security spending based on financial impact. - Exposure Factor (EF): Expressed as a percentage, this represents the portion of an asset's value that would be lost during a specific negative event (e.g., a fire damaging 50% of a server room). - Single-Loss Expectancy (SLE): The financial loss anticipated from one single incident. Calculated as AV × EF = SLE. - Mean Time Between Failures (MTBF): A manufacturer’s estimate of the average time a component will operate reliably before failing. - Mean Time to Repair (MTTR): The average time required to troubleshoot, fix, and return a failed system to functional status.

Asset Monitoring and Controls Monitoring systems ensures that hardware is physically and logically accounted for throughout its lifecycle. - Physical Controls: Barriers like locks (preventive) and "No Trespassing" signs (deterrent) protect tangible assets. - Deterrent Controls: Discourage potential attackers by highlighting the consequences of an action. - Preventive Controls: Proactively stop an incident from occurring by restricting access. - Detective Controls: Identify when a security boundary has been breached or an asset has been moved without authorization.

Quick Recall - SLE Formula: Asset Value (AV) multiplied by Exposure Factor (EF). - EF Measurement: Always measured as a percentage (%). - Reputation: A primary example of an intangible business impact. - MTBF: Key metric for predicting hardware reliability and scheduling replacements. - Total Cost of Loss: Includes both the hardware replacement and the lost revenue during downtime.