In the asset based approach of risk identification within the ISO, IEC 27,005 2022 framework.
Pinpointing and cataloging organizational assets is a critical first step.
Assets are broadly categorized into primary or business assets, which include valuable information
or processes crucial for the organization's functions, and supporting assets, which are the components
that uphold the information system that business assets rely on.
As we delve into risk assessment.
The development of risk scenarios requires meticulous linking of events, consequences, threats, and
vulnerabilities to these identified assets.
Each control measure in the risk treatment phase is tailored to specific subsets of assets, underlining
the importance of accurate asset identification.
Primary assets are typically involved in the event based approach, where the focus is on identifying
events and their potential impact on business operations.
Supporting assets, on the other hand, are more closely associated with the asset based approach.
Here, the emphasis is on the analysis of each asset's vulnerabilities and threats, as well as in the
risk treatment process, where each control is applied to the appropriate asset.
The interconnection between business and supporting assets is significant because risks identified for
supporting assets can have cascading effects on business assets.
Understanding these relationships and the value of each asset is imperative.
Misjudging an asset's value may not only skew the perceived consequences of associated risks, but can
also distort the perceived likelihood of threats.
Consider, for example, a supporting asset that hosts critical business information.
This data is shielded by a plethora of controls, both internal and external, aimed at thwarting any
risk source from exploiting vulnerabilities in the supporting asset to compromise the business asset.
To effectively manage these risks, the interdependencies between assets must be thoroughly documented.
Asset dependency graphs are invaluable in this context, providing a visual representation of these
relationships and helping ensure comprehensive risk assessment.
Taking the case of a web portal essential for showcasing order and invoice processing, we can see how
various assets contribute to the process.
An administrator, a human resource asset might, if inadequately trained, introduce a risk to the
business asset.
Likewise, maintenance services, a service asset that failed to keep IT infrastructure in check, can
propagate risks.
Should a server, a hardware asset malfunction, or a network a network connectivity asset be misconfigured?
The business asset, in this case the web portal application, might be rendered inoperative or inaccessible,
directly impacting the business process and consequently the customer experience.
This scenario highlights the crucial nature of each supporting asset, and the importance of having
a comprehensive understanding of the entire asset ecosystem for effective risk management.
The first step in the asset based risk assessment process is to identify information assets that needs
to be protected.
Example of assets includes servers, routers, switches, and any other hardware.
Client contact information, sensitive partner documents.
Trade secrets.
Any other important data or information.
Also, people like important employees with high skills and expertise are considered as assets.
Remember that what we think is valuable might not be what is actually most valuable for the business.
Therefore, we need to work with business users and management to create a list of all valuable assets.
For each asset.
An owner should be identified.
Because most organizations have a limited budget for risk assessment, we will likely have to limit
the scope of the project to mission critical assets.
Accordingly, you need to define a standard for determining the importance of each asset.
Common criteria include the assets, monetary value, legal standing, and importance to the organization.
Once the standard has been approved by management and formally incorporated into the risk assessment
security policy, use it to classify each asset you identified as critical, major, or minor.