Specification for asset identification 1.1

Abstract

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation"s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL"s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL"s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. AbstractAsset identification plays an important role in an organization"s ability to quickly correlate different sets of information about assets. This specification provides the necessary constructs to uniquely identify assets based on known identifiers and/or known information about the assets. This specification describes the purpose of asset identification, a data model for identifying assets, methods for identifying assets, and guidance on how to use asset identification. It also identifies a number of known use cases for asset identification.

Cyber Security Risk Assessment of a DDoS Attack

“…Many established ISRM methods center around assets, the NIST Specification for Asset identification [169] uses three main classes of information system related assets; (i) Persons, (ii) Organization, and (iii) Information Technology. In addition, it provides nine sub-classes of assets of Information technology.…”

“…Knowledge is viewed as an intangible asset [147], but e.g. is not included in the asset overviews in [169] or [15]. However, loss of availability due to lack of knowledge is a plausible IS risk (e.g.…”

Risk Management Processes

“…SCAP content benefits from multiple sources, among them the National Vulnerability Database (NVD) or the MITRE Open Vulnerability and Assessment Language (OVAL) Database [30]. SCAP also defines the Asset Identification (AI) specification [31]. Its primary use is better correlation, assessment and management of every asset-related piece of information (vulnerabilities, weaknesses, alerts, system events).…”

A Comparison between Business Process Management and Information Security Management

“…Knowledge is viewed as an intangible asset [37], but e.g. is not included in the asset overviews in [28] or [6]. However, loss of availability due to lack of knowledge is a plausible IS risk (e.g.…”

“…Many established ISRM methods center around assets, the NIST Specification for Asset identification [28] uses three main classes of information system related assets; (i) Persons, (ii) Organization, and (iii) Information Technology. In addition, it provides nine sub-classes of assets of Information technology.…”