System Inventory
Purpose
This page provides a structured inventory of all technical systems within the Scheol Security Lab.
The objective is to:
- maintain a clear view of existing infrastructure
- support risk analysis and control definition
- ensure traceability between systems, services and architecture
This inventory reflects the actual deployed environment, not a target architecture.
Scope
The inventory includes:
- VPS (public infrastructure)
- on-premise systems (Proxmox, internal VMs)
- critical supporting components
It does not include:
- logical services (covered in Service Reference)
- controls or configurations
- detailed architecture descriptions
Note on Asset Representation
In the Scheol Security Lab, technical systems (VPS, services, infrastructure components) are represented as assets (A-XXX).
This ensures:
- consistency across documentation
- direct traceability between assets, risks and controls
- simplified architecture and risk mapping
Inventory Model
Each system is described using the following attributes:
| Field | Description |
|---|---|
| Asset ID | Unique identifier (A-XXX) |
| Name | System name |
| Type | VPS / VM / Physical |
| Location | Heaven / Hell |
| Role | High-level purpose |
| Exposure | Public / Internal |
| Criticality | Low / Medium / High |
| Notes | Optional context |
System Inventory
Public Infrastructure (Heaven)
| Asset ID | Name | Type | Location | Role | Exposure | Criticality | Notes |
|---|---|---|---|---|---|---|---|
| A-050 | VPS-01 | VPS | Heaven | Reverse proxy, documentation, Gitea (co-located) | Public | High | Main entry point, multi-service exposure |
| A-051 | VPS-02 | VPS | Heaven | Business application (Dolibarr) | Public | High | Handles business data |
Internal Infrastructure (Hell)
| Asset ID | Name | Type | Location | Role | Exposure | Criticality | Notes |
|---|---|---|---|---|---|---|---|
| A-020 | Proxmox Host | Physical | Hell | Virtualization platform | Internal | High | Core infrastructure |
| A-028 | Internal Network | Logical | Hell | Network segmentation & internal communication | Internal | High | Managed via firewall |
Planned / In Progress Systems
| Asset ID | Name | Type | Location | Role | Exposure | Criticality | Notes |
|---|---|---|---|---|---|---|---|
| A-027 | NAS / Storage | Physical / VM | Hell | Data storage and backup (partial) | Internal | High | Backup strategy incomplete |
| A-022 | Bastion Host | VM | Hell | Controlled administrative access | Internal | High | Not yet deployed |
| A-035 | Wazuh Server | VM | Hell | Centralized logging and detection (SOC) | Internal | High | Planned |
| A-038 | Monitoring Stack | VM | Hell | Metrics and system monitoring | Internal | Medium | Prometheus / Grafana planned |
| A-033 | Automation Node | VM | Hell | Ansible / CI-CD control | Internal | High | Not fully implemented |
Observations
- Public services are concentrated on a limited number of VPS
- Internal infrastructure is centralized on a single host (Proxmox)
- Several critical systems are still in planned or transitional state
- Some roles are co-located, increasing risk exposure
Known Limitations
At the current stage:
- inventory granularity is intentionally simplified
- dependencies between systems are not explicitly mapped here
- some internal components are grouped logically rather than individually defined
This reflects the current maturity of the lab.
Relationship with Other Sections
This inventory is used by:
- Risk Register → identification of exposed assets
- Control Framework → scoping of controls
- Architecture → mapping of zones and flows
- Validation & Monitoring → definition of monitored systems
Governance Rule
Any new system must be added to this inventory.
Updates must occur:
- after infrastructure changes
- when new systems are deployed
- when roles or exposure levels evolve
Current Maturity
At the current stage, system inventory is considered established but minimal.
Established
- identification of core systems
- separation between Heaven and Hell environments
- classification by exposure and role
In Progress
- refinement of system granularity
- alignment with service reference
- integration with risk and control mapping
Planned / Next Phase
- more detailed system decomposition (VM-level)
- mapping of dependencies between systems
- integration with monitoring and asset tracking
This page provides a clear and minimal source of truth for all systems in the Scheol Security Lab.