Chapter 22 — Information security: system and data models
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Why asset models matter"]
N2["22.2 The reconciliation lab"]
N3["Lab — Reconciling a synthetic asset register against"]
N4["22.3 Investigating gaps"]
N5["22.4 Owners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Why asset models matter"]
N2["22.2 The reconciliation lab"]
N3["Lab — Reconciling a synthetic asset register against"]
N4["22.3 Investigating gaps"]
N5["22.4 Owners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Why asset models matter]
|
v
[22.2 The reconciliation lab]
|
v
[Lab — Reconciling a synthetic asset register against]
|
v
[22.3 Investigating gaps]
|
v
[22.4 Owners]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) build an asset model; (2) reconcile records with observed reality; (3) assign owners to assets.
22.1 Why asset models matter
Organisations cannot protect what they do not know they have. Lindiwe builds a model of Saltmarsh's assets: devices, applications, data stores and the relationships between them. The starting point is the asset register maintained by the IT team. Prof. Hale warns that registers drift from reality, as devices are added without registration and old ones linger after removal, so the register must be checked against what is actually on the network before it is trusted. She asks the IT team for its latest register export first.
22.2 The reconciliation lab
The lab compares a synthetic register of 2,400 addresses with a synthetic discovery scan that found 2,373 active hosts. Ninety registered addresses did not respond, so they may be retired, switched off or wrongly recorded. Sixty-three hosts that responded were not in the register at all, all on one address range nobody had documented. Of the hosts seen on the network, 97.3 percent were registered. Lindiwe notes that both gaps need investigation, for different reasons. She presents the three figures in one table for the network team, with the unregistered range highlighted for urgent follow-up.
Lab — Reconciling a synthetic asset register against a synthetic discovery scan
"""Reconcile a synthetic asset register against a synthetic network discovery scan (stdlib only)."""
import random
random.seed(8)
register = {f"10.20.{i//250}.{i%250+1}" for i in range(2400)}
seen = set(random.sample(sorted(register), 2310)) # 90 registered hosts not seen
unknown = {f"10.30.0.{i}" for i in range(1, 64)} # hosts nobody registered
scan = seen | unknown
print(f"register {len(register)}; scan {len(scan)}")
print(f"registered but not seen {len(register - scan)}; seen but unregistered {len(scan - register)}")
print(f"register coverage of scan {len(scan & register)/len(scan):.1%}")
Run with python3 lab_assets.py. Verified output:
register 2400; scan 2373
registered but not seen 90; seen but unregistered 63
register coverage of scan 97.3%
22.3 Investigating gaps
The sixty-three unregistered hosts matter most, because unknown devices miss patches and monitoring. Lindiwe asks the network team about the undocumented range and learns it belongs to a depot's camera system installed by a contractor. The ninety silent registered addresses matter less for immediate risk but undermine trust in the register. She proposes checking them against disposal records and marking confirmed retirements. Prof. Hale notes that a single scan can miss devices switched off at the time, so scans should repeat. The camera range is scanned again.
22.4 Owners
Every asset needs an owner who decides how it is protected and answers for it. Lindiwe adds an owner field to the model and finds that the camera system has no owner at all, because the contractor left and the depot manager assumed IT was responsible. She arranges for the depot manager to own it, with IT providing support. She learns that ownership gaps often explain technical gaps, since nobody patches what nobody owns. The depot manager signs the ownership record, and the camera system is added to the patching schedule.
Worked example
Lindiwe reconciles 2,400 registered addresses with 2,373 scanned hosts, finds 90 silent registrations and 63 unregistered cameras, investigates both and assigns an owner.
Synthetic case. Addresses are synthetic; outputs come from lab_assets.py.
Errors and limits
An asset register that is never reconciled gives false confidence.
Exercises
- EX064 — Unregistered hosts. How many hosts were seen but not registered? Rubric: 3 = sixty-three;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX065 — Silent registrations. How many registered addresses did not respond? Rubric: 3 = ninety;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX066 — Camera owner. Who becomes owner of the camera system? Rubric: 3 = the depot manager;; 2 = partly correct;; 1 = IT;; 0 = none.
Continue studying — lesson 22 (chapter 22 of 50)
← Chapter 21 · Course chapter index · Chapter 23 →
Continue to the next authored lesson.