4

I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment procedure.

We can easily get a lot of information on hardware and software assets by running scripts. We will store all of it, because we never know what we might need. However, in the scope of a cyber security risk assessment, some of it will not be useful. For example: I understand that server IP addresses are important security-wise, but motherboard manufacturer and model name are not so much.

Is there a concrete set of asset details that are most relevant for an asset report for a security risk assessment discussion?

Or, equivalently,

Is there a set of asset details that are "too much", that can be safely omitted from the asset report?

  • 1
    You can check out Annex B of ISO 27005. I think the majority of your question(s) will be answered there. If not, I can write up an answer later. – Tom K. Feb 23 '18 at 15:17
  • @TomK. Thanks for the info, I looked up ISO 27005 and it is helpful. – Chris Feb 27 '18 at 7:42
4

You are tackling this problem backwards. You assess risks against threats. The threats inform you of what is relevant.

Is your risk that the hardware has a built-in backdoor from the government of the manufacturer's country? Then, yes, "motherboard manufacturer and model name" are crucial pieces of data.

Gathering tons and tons of data hoping that some piece of it might be useful is not the way to go. Figure out your threats then assess against them. There is no set standard to follow.

Sometimes an expert can help you add to the list of relevant items because they might understand the threats a little better than you do, so do not discount outside help, papers, or reports. That's why Threat Intel is a vital part of a risk process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.