Security Operations · Topic 4 of 13
Asset Management and Disposal
Security+ asset management: acquisition, ownership, inventory, enumeration, retention and safe disposal using sanitization, degaussing and destruction.
- 4 min
- Asset management covers acquisition, assignment, monitoring and disposal.
- Every asset needs an owner and a classification.
- Enumeration is active discovery, which helps find unknown assets.
What it is
Asset management means knowing what hardware, software and data the organization owns, who is responsible for it and what happens to it at the end of its life.
You cannot protect what you do not know about. An accurate inventory is the base for patching, monitoring, vulnerability scanning and incident response.
How it works
The asset life cycle
| Stage | Security aim |
|---|---|
| Acquisition and procurement | Buy from trusted sources and set security requirements in the purchase |
| Assignment and accounting | Record an owner and a classification for each asset |
| Monitoring and asset tracking | Keep the inventory current and detect unknown devices |
| Disposal and decommissioning | Remove the asset safely and protect the data on it |
Ownership matters because someone must be accountable for patching and for the data. Classification tells how strictly to protect the asset.
Acquisition and tracking in practice
Security begins at purchase. Buy from approved suppliers, write security requirements into contracts and check that devices arrive sealed and unaltered. Record each new asset at once, with its owner and classification, so that it is never unmanaged.
Tracking keeps the record true over time. Network scans and network access control can reveal devices that nobody registered, and change records should update the inventory when assets move, are upgraded or are replaced.
Inventory and enumeration
An inventory lists assets and their key details, such as location, owner, operating system and version. Enumeration is the active discovery of assets, for example scanning a network to find devices. It helps to find shadow IT and forgotten systems.
Tracking can use agents, network scans or tags and barcodes for physical items. Software inventory also covers licenses and versions, so that unsupported or unapproved software is found.
Data assets
Data assets need an owner, a classification and a retention period. Data retention rules state how long data must be kept and when it must be deleted. Keeping data longer than needed raises risk and cost, while deleting it too early can break legal or business rules.
Disposal and decommissioning
When an asset leaves service, the data on it must not be recoverable by the next holder.
| Method | Description |
|---|---|
| Sanitization | Removing data so that it cannot be recovered, while the device may be reused |
| Overwriting | Writing patterns over the data |
| Cryptographic erase | Destroying the encryption key so the data cannot be read |
| Degaussing | Using a strong magnetic field to erase magnetic media |
| Destruction | Physically damaging the media, such as shredding, pulverizing or incinerating |
| Certification | A record, such as a certificate of destruction, that proves the step was done |
Media sanitization guidance is published by the National Institute of Standards and Technology (NIST) in Special Publication 800-88. Choose the method based on the data's sensitivity and whether the media will be reused.
Why disposal matters
Discarded drives and devices are a common source of data leaks. Cloud storage and virtual machines also need disposal steps, such as deleting volumes and keys, and removing the asset from monitoring and access lists.
What to remember for the exam
- Asset management covers acquisition, assignment, monitoring and disposal.
- Every asset needs an owner and a classification.
- Enumeration is active discovery, which helps find unknown assets.
- Data retention rules state how long to keep and when to delete data.
- Sanitization removes data from media. Destruction damages the media physically.
- Cryptographic erase deletes the key to make encrypted data unreadable.
- Degaussing works on magnetic media, not on solid state drives.
- A certificate of destruction provides evidence that disposal happened.
For a solid state drive that holds sensitive data, favor cryptographic erase or physical destruction. Degaussing does not work on it.
Common mistakes
Deleting files and calling it sanitization. A normal delete leaves recoverable data.
Degaussing flash storage. Magnetic erasure does not work on solid state media.
Ignoring software and data in the inventory. Assets include licenses, applications and data, not only hardware.
Forgetting to update monitoring after disposal. A removed system should leave inventory, access lists and monitoring.
Keeping data forever. Without a retention period, old data raises breach impact and cost.
Resold or donated equipment must be sanitized first. Skipping this step has caused many public data leaks.
Check yourself
What is the purpose of data retention rules?
To state how long data must be kept and when it must be deleted.
Why is degaussing unsuitable for a solid state drive?
Degaussing works on magnetic media, and flash storage does not store data magnetically.
What does a certificate of destruction provide?
Evidence that media was destroyed or sanitized as required.
Topic 4 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.