Why is it considered a best practice to identify assets before performing vulnerability scans in the context of IT infrastructure vulnerability assessments?