Problem
Using the NIST Cybersecurity Framework, apply the Identify function to create an Asset Management Program to provide a complete picture of what, where, and how an organization's asset is being used. The goal is to provide documentation for the security analysts to assist them in asset utilization and security. The network diagram created in Week 1 should be used as a basis for the following sections:
I. For each asset shown in the network diagram, write 1-2 paragraphs describing what the asset is, where the asset is used, and how.
II. Create a table (see Table 2.2, Examples of Asset Classifications in the textbook reading) with the columns (Categories, Aspects, and Assets).
III. Determine a significance level (high, medium, low) for each organization asset based on confidentiality, integrity, and availability and add the asset to the respective grouping in the table.
IV. Classify each information asset by category (Tier 0, Tier 1, Tier 2, and Significant Systems) and place the asset in the respective grouping based on the level of sensitivity for the associated data to denote the impact of the loss of that asset, related data, or functionality would have.
V. Create a second table that shows the following information for each asset:
1) Owner of asset, role, and responsibility
2) Data policy (Yes/No) and information asset security management policy (Yes/No)
3) Data governance (Yes/No) - (data is protected under the statute, contract, or compliance/regulatory bodies)
• Create a third table that shows the following information:
1) Inventory of software applications
2) Current list of known vulnerabilities
3) Prioritization of each vulnerability by risk level
4) Application patch level (from software vendor if known)
5) Actions to patch or apply alternative control.