Vulnerability › Module 3 › Lesson 1
What Is an Asset
Name assets before scanners — hosts, services, and owners on $LAB_HOST you control.
Visual · what_is_asset
Asset definition literacy. $LAB_HOST only. Original Cyberlium.
Opening
You cannot assess what you have not named. Assets start with YOUR lab host — not the dorm /24.
An asset is anything with value to assess: servers, VMs, containers, web apps, databases, network gear you administer. VA teams tie assets to owners, criticality, and data classification before scanning. Cyberlium teaches asset vocabulary on $LAB_HOST — one lab VM with intentional services — not Shodan browsing of stranger infrastructure. You will NOT call 'every IP that replied' an asset without scope, or inventory classmate machines from DHCP logs. Next: Discovery Literacy.
1. Asset attributes analysts record
Hostname/IP, OS, role (web, db, jump), owner, criticality, last seen, data sensitivity. CMDB rows and spreadsheets carry the same fields at enterprise scale.
On $LAB_HOST, write one asset row: lab-vm, IP, OS, owner=you, criticality=lab-only, services TBD after discovery.
Command guide
Try these commands — Asset attributes analysts record
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CIS Asset Inventory — https://www.cisecurity.org/controls/cis-controls-navigator CISA SBOM — https://www.cisa.gov/sbom
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install nmap
macOS:
Command — copy this
brew install python3 brew install nmap
Windows: Download https://python.org/downloads/
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Assets YOU own: hosts, services, apps — not neighbor laptops')"
source "$HOME/cyberlium-lab/t18-lab.env"; nmap -sn "$LAB_HOST" -oG - | head -5Primary tools to practice this lesson: python3, nmap. Reference sites: CIS Asset Inventory (https://www.cisecurity.org/controls/cis-controls-navigator); CISA SBOM (https://www.cisa.gov/sbom). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Assets are scoped, not discovered by curiosity
Authorized VA starts from a scope list — not from scanning until something pings. Stranger hosts that appear in ARP tables are out until written engagement says otherwise.
Café Wi-Fi clients and dorm laptops are not your assets — leave them off the sheet.
3. Lab single-asset foundation
Cyberlium Module 3 builds inventory from $LAB_HOST outward — optional second lab service you installed yourself, never neighbor gear.
Ship: one completed asset row for $LAB_HOST. Next: Discovery Literacy.
4. What you ship: asset row for $LAB_HOST
Hostname, IP, OS, owner, criticality for YOUR lab VM. No classmate rows. chmod 600.
5. What you record before the next lesson
Date. Asset row fields. $LAB_HOST only. File t18-m03-l01-what-is-asset.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add every ARP entry as an asset. Inventory employer servers without ticket.
Right
Write one asset row for $LAB_HOST. Next: Discovery Literacy.
Mission: define YOUR lab asset
1) Fill hostname, IP, OS, owner, criticality for $LAB_HOST. 2) Note data sensitivity = lab-only. 3) No neighbor or café entries. Never inventory strangers.
Stuck? Ask Cyberlium AI Mentor
One honest row beats a fantasy CMDB of the whole internet.
Knowledge Check
APPLY: A VA asset row should include:
Multiple choice
Knowledge Check
APPLY: True or False: ARP neighbors automatically belong in YOUR VA scope.
True or False
Knowledge Check
APPLY: Cyberlium asset inventory starts with:
Multiple choice