What Is an Asset
Name assets before scanners — hosts, services, and owners on $LAB_HOST you control.
Visual · what_is_asset
Asset definition literacy. $LAB_HOST only. Original Cyberlium.
You cannot assess what you have not named. Assets start with YOUR lab host — not the dorm /24.
An asset is anything with value to assess: servers, VMs, containers, web apps, databases, network gear you administer. VA teams tie assets to owners, criticality, and data classification before scanning. Cyberlium teaches asset vocabulary on $LAB_HOST — one lab VM with intentional services — not Shodan browsing of stranger infrastructure. You will NOT call 'every IP that replied' an asset without scope, or inventory classmate machines from DHCP logs. Next: Discovery Literacy.
1. Asset attributes analysts record
Hostname/IP, OS, role (web, db, jump), owner, criticality, last seen, data sensitivity. CMDB rows and spreadsheets carry the same fields at enterprise scale.
On $LAB_HOST, write one asset row: lab-vm, IP, OS, owner=you, criticality=lab-only, services TBD after discovery.
Command guide
Try these commands — Asset attributes analysts record
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: python3, nmap. Reference sites: CIS Asset Inventory (https://www.cisecurity.org/controls/cis-controls-navigator); CISA SBOM (https://www.cisa.gov/sbom). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Assets are scoped, not discovered by curiosity
Authorized VA starts from a scope list — not from scanning until something pings. Stranger hosts that appear in ARP tables are out until written engagement says otherwise.
Café Wi-Fi clients and dorm laptops are not your assets — leave them off the sheet.
3. Lab single-asset foundation
Cyberlium Module 3 builds inventory from $LAB_HOST outward — optional second lab service you installed yourself, never neighbor gear.
Ship: one completed asset row for $LAB_HOST. Next: Discovery Literacy.
4. What you ship: asset row for $LAB_HOST
Hostname, IP, OS, owner, criticality for YOUR lab VM. No classmate rows. chmod 600.
5. What you record before the next lesson
Date. Asset row fields. $LAB_HOST only. File t18-m03-l01-what-is-asset.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add every ARP entry as an asset. Inventory employer servers without ticket.
- Right: Write one asset row for $LAB_HOST. Next: Discovery Literacy.
Mission: define YOUR lab asset
1) Fill hostname, IP, OS, owner, criticality for $LAB_HOST. 2) Note data sensitivity = lab-only. 3) No neighbor or café entries. Never inventory strangers.
Stuck? Ask Cyberlium AI Mentor
One honest row beats a fantasy CMDB of the whole internet.
APPLY: A VA asset row should include:
APPLY: True or False: ARP neighbors automatically belong in YOUR VA scope.
APPLY: Cyberlium asset inventory starts with: