A serial number does not read the disk

Lesson map

Lesson 06. Map, example, EX052.

flowchart TD
  R["A row names a device"] --> Q{"Which question is asked?"}
  Q -->|Which object was taken| S["Serial and usual place"]
  Q -->|Can the volume be read| E["The encrypted cell"]
  S --> N["The serial does not answer encryption"]
  E --> N

CIS starts from an inventory. Encryption is a different cell.

Logical drawing

spreadsheet columns
    short name, user, model, serial, usual place
quick-check cell
    encrypted is 0 or 1
stolen laptop
    no dated encryption answer was on file

Learning outcomes

After this chapter, you should be able to:

1. Separate an asset identifier from a measurement of confidentiality at rest.
2. State what the serial column is for in this theft.
3. Refuse to treat the front-desk computer, or the wiped cupboard machine, as a hidden FB key.

6.1 An inventory answers "which object." A protector answers "who can read it."

CIS Controls v8 begins with an inventory of enterprise assets because a safeguard cannot be aimed at a device the organisation cannot name. Leah's spreadsheet is that inventory for a very small fleet: a short name, the person who uses it, the model, the serial number, and the place the device normally lives. The serial is an identifier the food bank can hand to the police and to the insurer. The usual-place column is a risk fact of a different kind: a laptop that goes home in a car is exposed to theft in a way a machine that stays in the office is not. Neither column inspects the disk.

Disk encryption is the second cell of the quick-check list, not a property of the serial string. In the embedded dictionary the encrypted cell is 0 for FB02, FB06, FB07, and FB11, and 1 for the other eight. That pattern is how the print reaches encrypted 8/12. A serial number, even a correct one, does not reveal those bits. The stolen laptop is the case that makes the split concrete. Nobody could say whether that volume was encrypted or what files it held. A serial would have named the object. It would not have answered the protector question, because no dated encryption measurement had been stored.

The spreadsheet also contains devices the script never sums. Chapter 1 names the twelve laptops, the shared front-desk computer, and an old laptop found in a cupboard. The cupboard machine is wiped and recycled, and the disposal is recorded. It is not given an FB key in the program. The front-desk computer remains in the prose and remains outside laptops. Adding either machine to the denominator would be a new instrument. NIST SP 800-53 Rev. 5 can name media sanitization as MP-6 and protection of information at rest as SC-28. The disposal note's date, the recycler's name, and any asset-tag sticker are unprinted, so the cupboard exit cannot be reconstructed from this page.

6.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No serial, report number, or insurer is written in the book.

Errors and limits

A recycled machine with a disposal record is not an uncounted row in the quick check. The record and the dictionary are different lists.

Apply

• EX052 — Identifier or protector? A classmate says the serial column proves encryption, and that the wiped cupboard laptop should be added as another key in the twelve-row print. What do you keep, and what do you refuse?
  Show marking criteria

  Rubric: 3 = the serial names the object and does not read the disk; encrypted stays 8 of 12 with zeros on FB02, FB06, FB07 and FB11; the cupboard machine stays wiped and outside the dictionary; no serial string is invented;; 2 = the serial and the encrypted cell stay different;; 1 = one refusal;; 0 = none.