ISC2 Certified in Cybersecurity (CC)Security OperationsEasy
A small non-profit organization is struggling with managing its IT assets. They have a mix of old and new computers, servers, and software licenses, some of which are no longer in use but are still consuming resources or posing potential security risks due to lack of updates. Which of the following security operations activities would BEST help them gain control over their IT environment and identify what needs to be secured?
- AAsset management
- BPhysical security
- CSecurity awareness training
- DData classification
Show answer & explanationAnswer & explanation
Correct answer: A. Asset management
Asset management is the process of identifying, tracking, and managing all IT assets within an organization. This helps in understanding what needs to be protected, identifying obsolete assets, and ensuring proper resource allocation and security controls.
Why the other options are wrong
- B. Physical security protects physical locations and devices, but doesn't help in identifying and inventorying all IT assets first.
- C. Security awareness training focuses on educating users, not on inventorying IT assets.
- D. Data classification organizes data based on its sensitivity, not the IT assets themselves.
Asset Management
The process of identifying, tracking, and managing all IT assets (hardware, software, data, etc.) throughout their lifecycle.
- Helps understand what needs protection
- Includes hardware, software, and information assets
- Supports budgeting and resource allocation
Memory trick: Assets are like puzzle pieces; you need to know all of them to solve the security picture.