Auditee : Hi There ! Welcome, What would you like to have? Tea or Coffee?
Auditor: Asset Register !
A comprehensive Asset Register is something which is quintessential
for any risk management program. Everything that has to do with risk,
follows from here. Information Security Risks are no different that any
other type of risks. Having a few people (rarely security pro) building
asset register will probably mess up any risk management at the very
first stage. It has been seen that people generally miss to address
technologically advanced assets (The ones they did not understand a few
years ago) to register in their asset inventory. The most obvious are
the virtual machines.
Auditor: Asset Register !
A comprehensive Asset Register is something which is quintessential
for any risk management program. Everything that has to do with risk,
follows from here. Information Security Risks are no different that any
other type of risks. Having a few people (rarely security pro) building
asset register will probably mess up any risk management at the very
first stage. It has been seen that people generally miss to address
technologically advanced assets (The ones they did not understand a few
years ago) to register in their asset inventory. The most obvious are
the virtual machines.
Every day ,Virtual Machines (VM) are being created on the fly as
per business requirement, many of them persist for years and many not so
much. There are many questions like: if that particular VM is of some
value? Do I need to consider it as valuable at this point of time, when I have nothing in it? What if my organization is in a business to
create and destroy hundreds of VMs every single day, What should i do
then? All these and many more unanswered questions might become
overwhelming sometimes. This is because there is no one right answer for
all these.
Many believe that this issue has come up due to scarcity of
competent resources who can understand the complexity of such so called
"trivial activities". Now a days, security pros are paying more attention
to activities that are more popular (about which people are
talking/tweeting on internet). It has become a forgotten truth that
doing one activity nearly perfect, and the other not even to acceptable
levels, will create havoc.
Information security risk management have been constantly looked as
a basis before investing/deploying any control at all mature
organizations. Every single activity in risk management has the
capacity to create a deep and embarrassing repercussions later. It has
been recommended by the leaders to put a considerable amount of
energy/attention in all of the activities rather than the few we
fantasize about. Let it not become faux pas for your organization later!
Comments
Post a Comment