4.2 Explain the security implications of proper hardware, software, and data asset management

Breakdown 1 — The asset lifecycle

Acquisition/procurement → Assignment/accounting → Monitoring/tracking → Disposal/decommissioning. Security shows up at every step: you can't protect what you don't know you have, and you leak what you don't destroy.

Stage	What to do	Security implication
Acquisition / procurement	Buy from approved vendors; evaluate security before purchase; standard configs; license compliance	Supply-chain risk, counterfeit hardware, unsupported software
Assignment / accounting	Record an owner (accountable person) and a classification (how sensitive the data/asset is)	Ownership drives who approves changes and access; classification drives controls
Monitoring / asset tracking	Inventory (authoritative list — CMDB) and enumeration (discover what's actually on the network with scans/agents)	Finds shadow IT and rogue devices; enumeration vs. inventory gaps = unmanaged risk
Disposal / decommissioning	Sanitization (make data unrecoverable but keep the device: wipe/overwrite, crypto-erase, degauss) · Destruction (physical) · Certification (certificate of destruction from the vendor for the audit trail) · Data retention (don't destroy what law/policy says to keep)	Data remanence on drives, copiers, phones

From class — secure media destruction: pulverizing, pulping (paper), incineration, shredding. Class also listed asset management under the secure personnel/policy chapter: clean desk, separation of duties.

Breakdown 2 — Sanitization vs. destruction (exam favorite)

Method	Type	Reusable after?	Notes
Overwrite / wipe (multiple passes)	Sanitization	Yes	Works for HDD; unreliable on SSD (wear leveling)
Cryptographic erase	Sanitization	Yes	Destroy the encryption key on an SED — instant
Degaussing	Sanitization/destruction	HDD/tape: no (drive is ruined); SSD: doesn't work	Magnetic media only
Shredding / pulverizing / incineration	Destruction	No	Highest assurance; get a certificate
Pulping	Destruction	No	Paper

Data retention — policies/regulations (SOX, HIPAA, legal hold) may require keeping data for years; disposal must check retention first. Retention also limits liability: don't keep what you don't need.

Breakdown 3 — Why the exam cares

• A lost, unencrypted, untracked laptop is a breach you can't even scope.
• Software inventory feeds vulnerability management (4.3): you can't patch what you don't list.
• Ownership + classification are what let you apply least privilege and DLP correctly.
• Certificates of destruction are evidence for auditors (5.5).

Exam tip: "Ensure data can't be recovered but reuse the drives" → sanitize (crypto-erase/overwrite). "SSD" → crypto-erase or destroy, not degauss. "Need proof for the auditor" → certificate of destruction. "Which asset lifecycle step finds devices nobody registered?" → enumeration.

Quick self-check

• Inventory vs. enumeration? (What you recorded vs. what you discovered.)
• Why doesn't degaussing work on SSDs? (Not magnetic.)
• Four destruction methods from class? (Pulverize, pulp, incinerate, shred.)