Identifying the Assets
When identifying the assets that need to be protected, some
might be obvious, like valuable proprietary information such as product
blueprints or designs, intellectual property, and the many hardware components
that make up the network. Others might not be so obvious, though, and are often
overlooked, such as the people using the systems. While the company doesn’t own
the people, it could have invested in their skills and development over the
years. Similarly, the company might rely heavily on those skills to meet its
business objectives. Some users might have no readily identifiable replacements
within the current workforce.
The point is to list everything that could be impacted in any way
by a security problem:
-
Hardware Servers, workstations, laptops,
printers, scanners, FAX units, routers, switches, firewalls, intrusion detection
devices, wireless access points, IP telephones, palm-sized devices, pagers,
projection systems, electronic white boards, and communication lines. Don’t
forget devices that might be at telecommuters’ homes, such as DSL routers,
printers, and so forth. The move to combine resources like printers and copiers
should be acknowledged, even if not yet implemented.
-
Software User software licenses, custom
and off-the-shelf enterprise applications, virus protection software, network
and workstation OSs, network device OS, network management applications,
utilities of all types, diagnostic programs, and communication/FAX programs.
-
Data Financial records, business plans and
strategies, customer and employee information, sales records (including credit
card information), product designs and parts lists, inventories, production
schedules, and customer and vendor contracts. Many of these could be parts of
one or more databases, while others might be many individual documents in the
system. Each type must be identified by its location during execution, where
they’re stored online, where they’re archived offline, any backups, audit logs,
and whether they’re ever transmitted over communication links. It isn’t uncommon
to discover entire classes of strategic documents stored only on local hard
drives.
-
People Users, administrators of all types,
help desk people, and hardware maintenance.
-
Documentation and licenses For OSs,
applications, hardware, systems, and administrative procedures. Don’t forget
service agreements and warranties.
-
Supplies Paper, toner and ink cartridges,
and batteries.
-
WAN and Internet services Contracts and
service agreements for communications links, web hosting services, and related
contracted services of any kind. Because these services could be in negotiation
for some time, be sure to include any works in progress.
While not technically a network component and not appropriate
for all companies, as previously mentioned, any company doing business over the
Internet ought to consider its reputation and the trust relationships it’s
developed as an asset. Any attack that damages this reputation could have
serious implications for the future well being of that company and its
stakeholders.
122 times read
|
Sections
Comments (0 posted)
Syndication
