Lessons · Cybersecurity · an asset and its owner
An asset, and the person who owns it
An asset is anything worth protecting, and every asset has an owner: the one person who decides how it is protected and who may use it.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
At 3 a.m. the alert says the HR database is being copied. The first thing the analyst needs is a name: whose is it, who can say whether that copy is normal, who can approve pulling it offline. If no one owns it, everyone waits.
How to think about it
List what you have before you list what threatens it. For each asset write what it is, where it lives, what it is worth, and one name. That list is the start of every risk assessment.
Worked example
Asset: customer database, 40,000 records, on server DB01What it is and where it lives.
Value: about $200,000 to rebuild and notifyA number, however rough. Risk arithmetic needs one.
Owner: head of customer serviceOne person, not a team. A team cannot be phoned at 3 a.m.
Classification: confidentialThe label that says who may see it and how it must be stored.
Your turn
Every asset on the register carries one name. Write what that name is called.
asset register column: the
Solve one, graded on the server
The trap
Listing hardware and forgetting data. The laptop is worth $1,200; the unencrypted client files on it are worth the company.