IFO4

CFO-R Course/Chapter 5 , Signal & Exposure/§5.2

§5.2 , 20 min read

Asset discovery & continuous inventory

Real-time discovery of every resource that exists under the organization.

Most organizations discover assets reactively - a cost spike surfaces an unknown project, an incident surfaces an unregistered service. Ring 5 discipline inverts that cycle. Every asset is discovered at the moment of creation and registered against the owning ring controls.

The inventory loop

▸Cloud Asset Inventory feed at org level, writing to a PubSub topic.
▸SaaS discovery via financial data: every charge that matches a SaaS MCC code surfaces to the inventory.
▸Data store registration required at creation; unregistered stores cannot join the service mesh.
▸All discovery events flow into a single BigQuery dataset for aggregate analysis.

# Enable continuous asset inventory for the IFO4 org
gcloud asset feeds create ifo4-asset-feed \
  --organization=1020051113207 \
  --asset-types=".*" \
  --pubsub-topic=projects/${PROJECT}/topics/asset-feed \
  --content-type=RESOURCE

The inventory is the ground truth. Any resource that exists but does not appear in the inventory is a Ring 5 finding. Any resource in the inventory that no longer exists is a Ring 4 attribution finding.

Study questions

Confirm your comprehension.

Question 1

Under Ring 5, when should a new asset be discovered?

Question 2

Unregistered data stores must:

Question 3

A resource that exists but is not in the inventory is:

 Previous

§5.1 , Doctrine , why detection is upstream of enforcement

Next 

§5.3 , Cost anomaly detection

IFO4