Let's talk about asset selection and what constitutes asset selection we can see here in front of as
examples of assets that we've talked about like files accounts financial information emails identity
etc. These are good examples of things that might be valued assets.
These then relate to privacy anonymity and pseudo anonymity as we've discussed.
The assets have security controls possible vulnerabilities threats and adversaries.
How we define what our assets will depend on the entity you are trying to protect.
So beyond information data accounts devices You may also want to assign things like functions departments
processes and other such things as assets to because these things of value too.
And if they are exploited there is an undesirable impact.
So for example if the entity you're trying to secure is a banking application and you are the security
architect the log in function for that banking app might be considered an asset.
The logging function would have security controls like import validation.
It would have threats like hackers series if you're operating a business the financial or sales department
could be an asset with its own special security controls threats and adversaries.
Another example in a business the process of say how people are dealt with when they resign and leave
the organization could be considered an asset.
This relieving process having the security control for example of making sure that people's credentials
are removed out of the business system.
A very important process and people leave something that is often forgotten in businesses information
and data.
As we've discussed can also be a way to categorize something as an asset.
So data is often assigned as an asset in some way and that data can often be assigned a classification
like secret confidential sensitive or public and so on.
So there are degrees to which security controls need to be applied to the asset based on its classification
how granular you are with assets will depend on the entity being protected within the security industry.
Different organizations provide different recommendations for assigning assets and this assignment of
assets is usually done in the early stages of what is called The risk assessment process or a risk assessment.
The further information if you want has done more about risk assessments you can look at places like
sabse ISO particularly ISO twenty seven thousand five and the information security forum or just do
a search for information security risk assessments and you can see what you find there.
But essentially we're talking about asset selection and really you want to pick the assets that make
sense to you and with experience that will guide you in the end to what are the best assets based on
the entity that you're trying to protect.