Chapter 4: Asset Management

A foundational axiom of information security asserts that an organisation cannot protect, monitor, or defend what it does not know it owns. In the high-velocity, multi-currency financial environment of the GIFT International Financial Services Centre (IFSC), asset management constitutes the essential prerequisite upon which all other defensive controls—including vulnerability patching, access control, security monitoring, and incident response—depend.

Asset management is defined as the systematic, documented process of identifying, cataloguing, classifying, assigning ownership of, and protecting an organization’s information and technology assets across their complete lifecycle, from initial requisition to secure decommissioning and physical destruction.

                         THE 5-PHASE ASSET MANAGEMENT LIFECYCLE
                                            │
        ┌───────────────────┬───────────────┴───────────────┬───────────────────┐
        ▼                   ▼                               ▼                   ▼
 [ 1. Requisition & ]   [ 2. Baseline Config & ]      [ 3. Operation & ]    [ 4. Maintenance & ]
 [ Procurement ]        [ Deployment ]                [ Monitoring ]        [ Patching ]
 - Approved vendors     - Hardened golden image       - Active telemetry    - Patch cadence
 - Hardware specs       - Removal of defaults         - Periodic audits     - Config review
 - Initial tagging      - CMDB auto-registration      - Access control      - Health metrics
                                                                                    │
                                                                                    ▼
                                                                           [ 5. Retirement & ]
                                                                           [ Decommissioning ]
                                                                           - Data sanitisation
                                                                           - NIST SP 800-88
                                                                           - Certificate of
                                                                             destruction

The 5 Primary Categories of Information Technology Assets

An enterprise asset management programme must maintain comprehensive visibility across five distinct domains:

The Configuration Management Database (CMDB)

To maintain real-time operational and security visibility, regulated entities in the GIFT IFSC deploy an enterprise Configuration Management Database (CMDB):

• Configuration Items (CIs): Every managed asset is represented in the CMDB as a Configuration Item, storing essential metadata: unique asset tag, serial number, hardware specifications, IP address, MAC address, operating system build, installed software packages, physical location, assigned Business Owner, and Technical Custodian.
• Dependency Mapping: The CMDB maps upstream and downstream interdependencies between CIs (e.g., mapping which core banking application depends on which specific database cluster, SAN storage volume, and network switch).
• Incident and Change Correlation: When a security incident occurs or an emergency patch is required, the CMDB allows security analysts to immediately understand the entire blast radius and identify all connected systems at risk.

Not all information assets carry identical organizational value or risk. Attempting to apply the highest degree of security controls uniformly across every server, workstation, and document is neither economically viable nor operationally practical. Consequently, asset management relies upon systematic asset classification and clear demarcation between Asset Ownership and Asset Custodianship.

                   INFORMATION ASSET CLASSIFICATION MATRIX
                                       │
         ┌───────────────────┬─────────┴─────────┬───────────────────┐
         ▼                   ▼                   ▼                   ▼
    [ PUBLIC ]          [ INTERNAL ]       [ CONFIDENTIAL ]      [ RESTRICTED / SECRET ]
  Freely available    Staff access only   Business sensitive   Extreme sensitivity
  - Press releases    - Intranet policies - Financial ledgers  - Trading algorithms
  - Public marketing  - Organization      - PII / KYC data     - Master HSM private keys
    brochures           charts            - Vendor contracts   - MII order matching source

1. Enterprise Information Classification Scheme

Financial institutions operating under the purview of the IFSCA must classify data and supporting technical assets into standardized tiers:

1. Public: Information intended for unrestricted public dissemination. Unauthorized disclosure causes zero organizational harm. Controls focus entirely on preserving data integrity against unauthorized alteration or website defacement.
2. Internal Use Only: Information intended exclusively for employees and authorized contractors in the normal conduct of business (e.g., internal operating procedures, phone directories, standard memos). Unauthorized disclosure causes minor operational inconvenience.
3. Confidential: Sensitive commercial or personal information whose unauthorized disclosure could cause significant financial loss, legal penalties, or customer distress. Includes customer bank account statements, employee compensation files, non-public regulatory communications, and third-party commercial contracts. Requires encryption at rest and in transit, strict RBAC, and access auditing.
4. Restricted / Secret: The most critical organizational information whose unauthorized disclosure or compromise would inflict catastrophic, existential damage on the firm's commercial viability, national financial stability, or market integrity. Includes algorithmic trading proprietary source code, cryptographic master keys stored in Hardware Security Modules (HSMs), core exchange matching engine binaries, and unannounced merger filings. Requires dual-custody access, hardware-enforced isolation, air-gapped storage, and continuous audit logging.

2. Differentiating Asset Ownership and Technical Custodianship

A major source of compliance vulnerability in financial institutions is the conflation of asset ownership with IT operational maintenance. The IFSCA framework strictly separates these fiduciary responsibilities:

3. Critical Information Infrastructure (CII) in Financial Markets

Under Section 70 of the Information Technology Act, 2000, and National Critical Information Infrastructure Protection Centre (NCIIPC) guidelines, certain financial assets are designated as Critical Information Infrastructure (CII):

• Definition: Any computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health, or safety.
• Application in GIFT IFSC: Core order-matching engines of international stock exchanges, clearing corporation risk engines, central securities depositories (CSDs), and real-time gross settlement (RTGS) payment switches are designated as CII.
• Statutory Mandates: CII systems must maintain 24/7 dedicated SOC monitoring, air-gapped disaster recovery ledgers, continuous real-time data replication, and independent annual audits by CERT-In / IFSCA-empanelled auditors.

The perimeter of modern financial institutions has expanded far beyond physical corporate offices. The proliferation of multi-cloud subscriptions, Software-as-a-Service (SaaS) tools, remote telework, and mobile devices creates fertile ground for Shadow IT and unmanaged assets, substantially expanding the external attack surface.

                   ATTACK SURFACE EXPANSION & REMEDIATION
                                      │
         ┌────────────────────────────┼────────────────────────────┐
         ▼                            ▼                            ▼
  [ SHADOW IT / ASSETS ]       [ LEGACY & EOL SYSTEMS ]     [ ATTACK SURFACE REDUCTION ]
  - Unauthorized SaaS tools    - Outdated OS (Win 2008)     - Continuous passive scanning
  - Rogue cloud buckets (S3)   - Unpatched vulnerabilities  - Shodan / Censys external audits
  - Developer test servers     - Vendor ceases patches      - Compensating controls:
  - Personal BYOD devices      - Technical debt               • Strict network isolation
                                                              • Read-only access
                                                              • Virtual patching (IPS)

1. The Threat of Shadow Assets

Shadow Assets (or Shadow IT) refer to hardware, software, cloud services, databases, or API integrations procured, deployed, or operated by employees, business units, or third-party vendors without the explicit knowledge, review, or approval of the IT and Cybersecurity departments.

• Primary Vectors in GIFT IFSC:
  • Developers creating public Amazon S3 or Azure Blob storage buckets to share large transaction testing datasets with overseas consultants.
  • Trading desks subscribing directly to third-party generative AI and market analytics SaaS platforms using corporate credit cards, pasting sensitive proprietary client data into external cloud prompts.
  • Unmanaged personal mobile devices (BYOD) accessing internal email and document management systems without Mobile Device Management (MDM) enrollment.
• Risks: Shadow assets lack enterprise anti-malware, miss automated patch deployments, bypass centralized SIEM logging, feature weak or default passwords, and violate statutory data residency and confidentiality mandates.

2. Automated Asset Discovery Techniques

To eliminate shadow assets and maintain continuous inventory integrity, regulated entities implement proactive discovery mechanisms:

1. Active Network Scanning: Automated tools (e.g., Nmap, vulnerability scanners) systematically sweep internal IP ranges, pinging hosts and probing open network ports (TCP/UDP) to discover newly connected physical and virtual machines.
2. Passive Network Traffic Analysis: Sensors positioned on core switch mirror ports (SPAN) continuously analyze network packets, identifying uncatalogued MAC addresses, hostnames, and anomalous outbound communication without injecting network latency.
3. External Attack Surface Management (EASM): Cloud-native scanners probe public internet IP space, domain registries, DNS zone transfers, and certificate transparency logs (e.g., utilizing reconnaissance engines similar to Shodan or Censys) to locate exposed corporate subdomains, forgotten test servers, and open database ports.
4. Endpoint Management Agents: Centrally managed agents (e.g., Microsoft Defender for Endpoint, CrowdStrike) installed on all corporate workstations and servers continually discover adjacent unmanaged devices connected to local subnets.

3. Managing Legacy and End-of-Life (EOL) Systems

Financial institutions frequently maintain core legacy systems that cannot be immediately rewritten or upgraded due to critical business continuity constraints.

• The End-of-Life (EOL) Hazard: When a software or operating system vendor declares a product EOL (e.g., Windows Server 2008, ancient database engines), the vendor permanently halts issuing security patches. Newly discovered zero-day vulnerabilities remain permanently unpatched, providing attackers with reliable exploit pathways.
• Mandatory Compensating Controls: Where business exigencies prevent immediate decommissioning of EOL systems, regulated entities must enforce strict compensatory safeguards:
  • Air-Gapping and Complete Network Isolation: The legacy machine must be sequestered in a dedicated, isolated VLAN with no direct internet access and zero routing to the corporate intranet.
  • Virtual Patching via Network IPS: Positioning an active Intrusion Prevention System (IPS) or Web Application Firewall (WAF) directly in front of the legacy host, programmed with specialized signatures to intercept known exploit traffic before it reaches the unpatched system.
  • Bastion Access and Session Recording: Administrative access must only be permitted through hardened jump hosts equipped with session recording and mandatory MFA.
  • Formal Risk Acceptance and Sunset Roadmaps: Senior Management and the CISO must formally execute a time-bound risk acceptance document, mandating complete system migration or decommissioning within an agreed statutory timeframe.