All set to start with the first lecture in which we are going to define information and asset.
Well, what is information and what is asset?
According to ISO 9000, that is quality management system information is a meaningful data.
Something that has a meaning or a fact provided is nothing more information.
Your name, your address, your e-mail address is information, the place you work, the organization
in you in which you are currently employed or your work is information.
Your password is information.
So facts provided or learned about something or someone is nothing but an information about what is
an asset when it comes to security.
You always will get to learn about this world asset.
So what is an asset?
An asset is an item thing or an entity that has potential or actual value to an organization.
Now, asset is something that is very valuable to an organization as it can be information that is a
meaningful data.
It can be a software or hardware, for example, when it comes to any idea that you design, that is
an asset for them.
Right.
Which has something very important.
Value is an asset then services people.
Yes, even people are assets.
For example, consider a person who has worked in an organization for 15 years and now he has suddenly
choose to, you know, resign.
So that is like losing the asset for the company, his brain, the way he worked or, you know, the
way he operated.
That is an.
Assets can also be intangibles, for example, the reputation and the image of you or your organization.
Yes, that is an asset.
So basically, to sum up, asset is something that has an actual value to an individual or an organization.
Now, there are a set of applications, services, information technology, assets, and there are specific
asset controls for maintaining the asset.
Now, according to ISO, IEC twenty seven thousand one, that is information security management systems,
there are four different controls for asset or control objectives for the asset.
Don't worry, we are going to see the controls and the control objectives as well.
But for the time being, let us foresee now according to that annex, it ought to dot one which defines
the responsibility of assets.
How should one handle the assets and what are the different controls associated with the asset?
So, for example, inventory of assets, which means the organization should identify the assets and
define appropriate protection responsibilities that comes under all this control of inventory of assets.
So if if an auditor finds out that the protection responsibilities have not been defined, he will draft
a nonconformity, saying that this controller.
Let me take my pen.
This control has been violated because the inventory of assets they can't control is not present.
Similarly, ownership of assets, which means the assets associated with the information and the information
processing facilities shall be identified and an inventory of assets shall be drawn up and maintained.
This is the inventory of assets now.
Ownership of assets, assets must be maintained in the inventory and they shall be owned.
They shall be owned by an organization.
There should be the person of the buyer, the receiver and the process that is being done with that
asset.
Then comes the acceptable use of assets, which means the rules for the acceptable use of information
and of assets associated with information and information processing facilities shall be identified,
documented and implement if there is a P.C. in your organization.
And if nothing about that book is present in any of the records, there is no point of having that use.
The auditors will question the existence of that device, right?
So this should be acceptable use defined of that asset.
And finally, is the return of assets, which means all the employees and external party users shall
return all the organizational assets in their position upon the termination of the employment contract
or agreement.
For example, you have retired from your organization and your organization has been providing you with
a laptop.
So it is your responsibility to return those laptops.
And according to this control, there shall be a process defined in order which the employee should
return the asset to the organization because the laptop or the PC is an asset is a valuable thing for
that organization.
Well, this is about this lecture.
To sum up.
We saw what is information.
We saw the definition of information along with the definition of asset.
We also saw the different types of asset.
And finally we saw the different controls that are being applied to information security management
systems when it comes to asset management.
I will see you in the next lecture.