If using the security triad of confidentiality, integrity and
availability, are these the only factors that define criticality?
While the CIA triad is important to us as security professionals when defining various criteria, the business often defines severity levels based on $$$.
They ask questions (from a business perspective) such as:
- What infrastructure / applications do we need in place to accept money
from customers? (think POS systems)
- What infrastructure / applications do we need in place to move money? (think wire/ACH systems)
- How much money do we lose per day if XYZ application is not available?
- Are there operations / processes that can be completed manually (paper, pen) until the systems are back online?
How does one calculate the cost of the associated risks? For example,
if the business deems a given set of assets as high across the entire
triad, how does one determine the impact, costs and risks?
This is where your quantitative and / or qualitative analysis comes into play from a risk perspective.
Below are a few good links that cover the formula in detail: