登录查看更多内容

What are the best practices for identifying assets in threat modeling?

由人工智能和领英社区提供技术支持

Threat modeling is a systematic process of identifying and analyzing potential threats to an organization's assets, such as data, systems, or people. It helps to prioritize and mitigate risks, as well as to design and implement security controls. One of the key steps in threat modeling is to identify the assets that need to be protected, as they are the targets of the attackers and the sources of value for the organization. In this article, you will learn some of the best practices for identifying assets in threat modeling, such as:

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

Xavier Vila i Espinosa

Privacy & InfoSec Watchdog & Trainer | Eur Ing, CISM, CRISC, CDPP, CDPSE, CISA, ISO22301 & ISO27k1 LA, CPCC, CTFO…

1 Define asset types and categories

Different assets may have different levels of importance, sensitivity, or exposure to threats. Therefore, it is useful to define asset types and categories that reflect the nature and characteristics of the assets, such as data, hardware, software, infrastructure, services, or people. For example, you can categorize data assets by their confidentiality, integrity, or availability requirements, or by their regulatory or contractual obligations. You can also group assets by their function, location, owner, or lifecycle.

添加您的观点

Shikha Kalesh

Supply Chain Risk Manager | Expert in Digitalising Risk Management, Transportation Risk Management & Strategic Sourcing | Driving Resilient and Innovative Supply Chain Solutions PhD researcher @University of Twente
举报内容
Exactly, a company would have external and internal assets that need to be monitored. These external and internal assets with also have multiple types among them, which needs to be categorised. These categorisation can be made based on the organisations segmentation, location, volume, static or dynamic assets etc. The organisation then has to set priority for which of these categories needs to be monitored constantly to avoid impacts from risk and that could disturb your business operations.

已翻译

赞

加载更多内容

2 Use multiple sources and methods

Identifying assets can be a difficult task, as many assets may be hidden, unknown, or undocumented. To gather information about the assets, it is recommended to use multiple sources and methods, such as interviews and surveys with stakeholders, documentation and inventories, tools and techniques, as well as standards and frameworks. For instance, stakeholders can include business owners, users, developers, or administrators. Documentation and inventories could consist of network diagrams, data flow diagrams, asset registers, or configuration files. Tools and techniques may include network scanning, data discovery, or asset management software. Examples of standards and frameworks are ISO 27001, NIST SP 800-30, or OWASP ASVS.

添加您的观点

加载更多内容

3 Focus on critical and valuable assets

When protecting an organization's assets, it is important to focus on the critical and valuable ones that require the most attention. To determine which assets are the most critical and valuable, you can use criteria such as business impact analysis, risk assessment, and asset valuation. Business impact analysis assesses the potential losses or damages that could result from a disruption or breach of the assets. Risk assessment evaluates the likelihood and severity of threats to the assets. Lastly, asset valuation estimates the monetary or non-monetary worth of the assets.

添加您的观点

加载更多内容

4 Update and review assets regularly

Assets are not static entities; they change over time due to factors such as business needs, technology evolution, or environmental conditions. Therefore, it is essential to update and review the assets regularly to ensure that they are accurate and current. This can help to identify new or modified assets, as well as to remove obsolete or redundant ones. Change management, audit and verification, and feedback and improvement are all useful methods for doing this. Identifying assets is a vital step in threat modeling, as it defines the scope and objectives of the security analysis. By utilizing these best practices, you can improve the quality and completeness of your asset identification, ultimately enhancing the effectiveness and efficiency of your threat modeling process.

添加您的观点

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Xavier Vila i Espinosa

Privacy & InfoSec Watchdog & Trainer | Eur Ing, CISM, CRISC, CDPP, CDPSE, CISA, ISO22301 & ISO27k1 LA, CPCC, CTFO, BSAFE, Private security manager
举报内容
Never forget asset dependencies. You can have a critical asset identified, categorized and so on, but if this asset depends on another one that has not the same critical considerations, you may face a great issue if the dependency fails and, in cascade, other assets as the one that can be considered critical. Doing a dependency relationship chart and trespassing this criticity to the dependencies can have an interesting point of view and may help to justify some budget in improvements.

已翻译

赞

加载更多内容

Risk Management

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the best practices for identifying assets in threat modeling?

1

2

3

4

5

1 Define asset types and categories

2 Use multiple sources and methods

3 Focus on critical and valuable assets

4 Update and review assets regularly

5 Here’s what else to consider

Risk Management

给文章评分

感谢您的反馈

更多Risk Management相关文章

更多相关阅读内容

What are the best practices for identifying assets in threat modeling?

1

2

3

4

5

1 Define asset types and categories

2 Use multiple sources and methods

3 Focus on critical and valuable assets

4 Update and review assets regularly

5 Here’s what else to consider

Risk Management

给文章评分

感谢您的反馈

查看其他技能