Network Defense Management · Topic 5 of 5
Awareness, Administrative Controls, Asset Management and Threat Awareness
Plan awareness training, use controls like separation of duties, manage IT assets through their lifecycle and track CVE, CVSS and threat feeds.
- 5 min
- Phishing simulations measure and improve awareness.
- Separation of duties, job rotation and mandatory vacation all reduce fraud risk.
- An asset needs an owner, a classification and a lifecycle plan.
What it is
People, inventory and information are the managed parts of defense. Awareness training teaches users to avoid mistakes. Administrative controls limit what any one person can do. Asset management makes sure the organization knows what it owns, and threat awareness keeps the defenders informed about new risks.
The exam asks for the purpose of each practice and for the correct name of a given control.
How it works
Security awareness training
Users are a common entry point for attackers, so training is a control, not a formality.
- Who: all employees at hire and then regularly, plus extra training for administrators, developers and executives.
- What: phishing and social engineering, passwords and multifactor, safe browsing, physical security, data handling, mobile and remote work, and how to report incidents.
- How: classroom or online courses, posters, newsletters, short videos, simulated phishing campaigns and role playing.
- Measure: completion rates, phishing simulation click rates and report rates, and incident trends.
- Keep fresh: repeat on a schedule and update content when new threats appear.
A culture where users report a suspicious email quickly is worth more than a perfect score on a test.
Other administrative security measures
| Measure | Purpose |
|---|---|
| Separation of duties | No single person completes a sensitive process alone, which reduces fraud |
| Least privilege | Give only the access needed for the job |
| Need to know | Access to information only if the task requires it |
| Job rotation | Moving staff between roles so hidden fraud is found |
| Mandatory vacation | Another person covers the role and can spot irregularities |
| Background checks | Screening before hiring |
| Nondisclosure agreement (NDA) | Legal duty to keep information secret |
| Onboarding and offboarding | Grant access at hire, remove all access and collect devices at exit |
| Change management | Approved, tested and documented changes |
| Acceptable use and signed policies | Users agree to the rules |
| Incident reporting procedures | Clear path to report events |
| Third party agreements | Security terms in vendor contracts |
Dual control needs two people to act together, such as two keys. Separation of duties splits one process across different people.
IT asset management
You cannot protect what you do not know you have. Asset management tracks hardware, software, data and services through their life.
| Lifecycle stage | Activity |
|---|---|
| Plan and acquire | Approve purchases and check vendors |
| Register | Record owner, location, version and criticality in an inventory or configuration management database (CMDB) |
| Classify | Assign a sensitivity level, such as public, internal, confidential or restricted |
| Operate and maintain | Patch, monitor and license track |
| Retire and dispose | Wipe or destroy data securely |
Discovery tools scan the network to find unknown devices and shadow IT, which is technology used without approval. Each asset needs an owner responsible for its protection.
For disposal, NIST SP 800-88 describes three levels of media sanitization: clear (overwrite), purge (stronger, such as cryptographic erase) and destroy (physical destruction).
Staying up to date on security trends and threats
| Source | What it gives |
|---|---|
| CVE | A unique ID for each publicly known vulnerability |
| NVD (National Vulnerability Database) | Details and scores for CVEs |
| CVSS | A 0 to 10 severity score: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high, 9.0 to 10.0 critical |
| Vendor security advisories | Patches and notices from the product maker |
| CISA and national CERTs | Alerts and known exploited vulnerability lists |
| ISACs | Industry groups that share threat information |
| Threat intelligence feeds | Indicators such as bad IP addresses and file hashes |
| Security news, blogs and mailing lists | Early notice of trends |
| Training and conferences | Ongoing skills |
Use the information in a loop: collect it, filter it for what applies to your assets, prioritize by severity and exposure, then patch or add a control.
A worked example
A new CVE with a CVSS score of 9.8 is announced for a VPN appliance. The security team checks the asset inventory and finds two such appliances, one of them internet facing and owned by the network team.
Because the inventory names the owner and version, the team patches the exposed device first within hours. Without the inventory, they might have missed the second appliance entirely.
How the exam asks about this
- "Which control prevents one employee from completing a financial transaction alone?" → Separation of duties.
- "What identifies a publicly known vulnerability with a unique ID?" → The CVE identifier.
- "What does an organization need before it can protect its devices?" → An accurate asset inventory.
What to remember for the exam
- Phishing simulations measure and improve awareness.
- Separation of duties, job rotation and mandatory vacation all reduce fraud risk.
- An asset needs an owner, a classification and a lifecycle plan.
- CVE names a flaw, and CVSS rates its severity from 0 to 10.
- NIST SP 800-88 media sanitization levels are clear, purge and destroy.
Deleting files or formatting a drive is not secure disposal. Recoverable data needs overwriting, cryptographic erase or physical destruction.
Common mistakes
Training once a year and calling it done. Awareness fades. Repeat it and use simulations to see what still works.
Mixing separation of duties and least privilege. The first splits a process between people, and the second limits one person's permissions.
Assuming a high CVSS score always means fix first. Severity matters, but so do exposure and whether the asset is important, which is why the inventory counts.
Check yourself
What is shadow IT?
Technology used in the organization without approval from IT or security.
Why is job rotation a security control?
A new person in the role can uncover fraud or errors that the previous holder hid.
What does a CVSS score of 9.5 indicate?
A critical severity vulnerability.
Topic 5 of 5 in Network Defense Management
Test yourself on Network Defense Management
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.