# Chapter 2: Asset management 

Source: Defensive Security Handbook: Best Practices for Securing Infrastructure by Lee Brotherston, Amanda Berlin

Each asset or group of assets must be assigned an owner and/or a custodian.

* Asset owner: point of contact for the asset
* Custodian: responsible for the stored information

Categorize the assets into different levels of importance based on the value of the information, and the cost to the company if an asset is compromised.

## Information classification
1. Identify data sources to be protected (uses tools where possible).
	* include description, location, existing protection measures, data owners and custodians, and the type of resource.
2. Classify: identify information classes and label them.
	1. Define critical assets (incl. firewalls, connections, etc.).
3. Map protections to set information classification levels.
4. Protect.
5. Audit yearly.


## Asset mgt implementation
Each department or person involved in each step should understand when and how assets are tracked at every point of their lifecycles.

* Procure
* Deploy
* Manage, e.g. moved to storage, upgraded, replaced, returned, or change of users, locations, or departments.
* Decommission

Track changes, monitor and report

