Security Operations and Incident Response · Topic 4 of 4
Asset Protection and Security Testing
Asset lifecycle and end-of-life systems, configuration and change management, patching, and security testing with red, blue and purple teams and scanning.
- 3 min
- Keep an inventory with owners; retire assets securely.
- Replace or isolate end-of-life systems.
- Change management approves changes, including new AI model versions, before production.
What it is
Asset protection keeps track of every system, device and tool the organization uses and keeps them in a known, approved, secure state. Security testing checks whether defenses actually work, from scanning for weaknesses to simulating real attackers and testing people and buildings.
How it works
Asset lifecycle management
- Acquire and record the asset in an inventory with a named owner.
- Configure it to a secure baseline.
- Operate and maintain: patch, monitor and review.
- Retire: remove data, sanitize media, revoke access, update the inventory.
An inventory with named owners is what reveals unrecorded assets, such as AI tools departments started using without telling IT. You cannot protect what you do not know about.
End of life (EOL) software and devices no longer receive security updates. Replace them; until then, isolate them and add extra controls.
Configuration and change management
| Process | Purpose |
|---|---|
| Configuration management | Define secure baselines and keep systems matching them |
| Change management | Assess, approve, test and schedule changes before they reach production, with a way to roll back |
| Patch management | Apply vendor fixes for known flaws, after testing, in a timely way |
A new version of an AI model is a change too: putting a vendor's new model straight into production without assessment can break business processes.
The main purpose of patches is to correct known flaws in software. Test them before wide deployment where systems are critical.
Security readiness testing (teams)
| Team | Role |
|---|---|
| Red team | Plays the attacker to find ways in |
| Blue team | Defends: detects and responds |
| Purple team | Red and blue working together so findings improve defenses directly |
Tests also differ by how much the tester knows: black-box (no inside information), gray-box (some information) and white-box (full information such as diagrams, source code and credentials).
Application testing
| Test | What it does |
|---|---|
| Vulnerability scanning | Automated search for known weaknesses; credentialed scans log in and see more |
| Static analysis | Examines source code without running it |
| Dynamic analysis | Tests the running application |
| Threat modeling | Identifies how a system could be attacked, ideally during design |
Scan results need checking: a false positive reports a flaw that is not there; a false negative misses a real flaw. Verify claims (for example that a vulnerable service is disabled) before closing or accepting a finding. CVSS gives a standard severity score to help prioritize fixes.
Physical penetration testing
Testers try to get into buildings or obtain information using phishing, tailgating (following someone through a secure door) and impersonation (posing as a contractor or employee). These tests check physical controls and staff awareness, and always need written authorization.
How the exam asks about this
- "Which practice would reveal AI tools IT never recorded?" An inventory with named owners.
- "Testers are given network diagrams, source code and admin credentials." A white-box test.
- "Which team combines attackers and defenders?" Purple team.
What to remember for the exam
- Keep an inventory with owners; retire assets securely.
- Replace or isolate end-of-life systems.
- Change management approves changes, including new AI model versions, before production.
- Red attacks, blue defends, purple combines them.
- Static analysis reads code; dynamic analysis tests the running app; scanning finds known weaknesses.
Any penetration test, including physical tests, needs written authorization first. Without it, testing is an attack.
Common mistakes
Running end-of-life systems without extra protection.
Skipping change management for "small" updates.
Confusing static and dynamic analysis.
Check yourself
What does a red team do?
It plays the attacker to find weaknesses.
What is tailgating?
Following an authorized person through a secure door without using your own access.
Which process should approve a new AI model version before production?
Change management.
Topic 4 of 4 in Security Operations and Incident Response
Test yourself on Security Operations and Incident Response
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.