Meet the city

You cannot protect what you do not know you have. The first job of a defender is an inventory: a list of the assets, meaning the things of value to protect.

Imagine a small invented town, Acmeton, with a school, a clinic, a shop and a council office. Its assets fall into a few groups:

• People and accounts: students, staff, shared mailboxes, the administrator account.
• Devices: laptops, tablets, phones, the printer, a door camera, a smart thermostat.
• Services and software: the web shop, e-mail, the booking system.
• Data: customer lists, medical notes, exam marks, payment records.
• Connections: the router, the Wi-Fi, the link to the internet.

Which assets are critical? Ask two questions of each one:

• If it were exposed, changed or unavailable, how bad would it be? (the CIA triad from lesson 1)
• How many other things depend on it?

The school's attendance records are more critical than the staff-room coffee machine, even if both have a network connection. A critical asset gets stronger layers, more careful updates and better backups. Spreading effort evenly over everything usually means under-protecting the few things that matter most.

A useful inventory records, for each asset: what it is, who owns it, where it is (on site, in the cloud, at someone's home), what data it holds and how critical it is. A simple spreadsheet is a fine start. Hidden or forgotten items, such as an old test server or a camera nobody remembers installing, are a classic source of trouble. An asset nobody knows about is an asset nobody updates.

Thinking like a defender. To understand risk, it helps to ask "if someone wanted to cause harm here, what would they go after, and what is the easiest way in?" Security people call this looking at the attack surface: all the places where a problem could enter. We ask the question only to decide what to strengthen, never to plan harm. Sometimes this is described as "the attacker's view", but the aim is purely protective.

In NIST terms, this lesson is the Identify function: know your assets, know the risks, set priorities. Everything that follows in the course builds on it.

One more rule for your own inventory: it is only for systems you own or are responsible for. Looking at, listing or probing somebody else's equipment without permission can be illegal, even when you mean no harm. Lesson 24 explains why.