Identify Assets
Before we can identify vulnerabilities, we must first decide what we need to protect. Thus, the first step of a risk analysis is to identify the assets of the computing system. The assets can be considered in categories, as listed below. The remaining items are not strictly a part of a computing system but are important to its proper functioning.
• hardware: processors, boards, keyboards, monitors, terminals, microcomputers, workstations, tape drives, printers, disks, disk drives, cables, connections, communications controllers, and communications media
• software: source programs, object programs, purchased programs, in-house programs, utility programs, operating systems, systems programs (such as compilers), and maintenance diagnostic programs
• data: data used during execution, stored data on various media, printed data, archival data, update logs, and audit records
• people: skilled staff needed to run the computing system or specific programs, as well as support personnel such as guards
• documentation: on programs, hardware, systems, administrative procedures, and the entire system
• supplies: paper, forms, laser cartridges, recordable media, and printer ink, as well as power, heating and cooling, and necessary buildings or shelter
• reputation: company image
• availability: ability to do business, ability to resume business rapidly and efficiently after an incident
You have to tailor this list to your own situation. No two organizations will have the same assets to protect, and something that is valuable in one organization may not be as valuable to another. For example, if a project has one key designer, then that designer is an essential asset; on the other hand, if a similar project has ten designers, any of whom could do the project’s design, then each designer is not as essential because there are nine easily available replacements. Thus, you must add to the list of assets the other people, processes, and things that must be protected.
