0

Looking at a plain system (there are no security controls implemented yet), we need to think about its functions and derive appropriate assets which we'd like to protect in order to ensure the system continues to function as intended (also making sure no intellectual property, private data, etc. are leaked).

My question is, do security measures themselves become assets once they are implemented? For example, we have a shared key to encrypt some data. This data is an asset with the property "confidentiality", to protect its confidentiality, we implement the security control encryption using said key.

The key in itself is not relevant to us, its just some random bits. Fundamentally, we still only care about the data being encrypted. However, the key is required to ensure the confidentiality of our data.

Does this in turn make the key itself an asset (we can argue that the key must remain confidential as well, since information disclosure of the key automatically results in information disclosure of our data). Or would you argue that storing the key securely is simply part of the security control/measure in the first place, thus it doesn't make sense to make the key a new asset and continue with risk analysis for this new asset.

Another example, messages transmitted are digitally signed to ensure authenticity/integrity. Now I have somewhere a function/code which performs the verification, as well as cryptographic key material. Would the verification functionality and keys/certificates become new assets on their own, or is it considered part of the mitigation in the first place to correctly/securely handle these.

Curious about your opinions on this topic.

Thanks!

Improve this question
1
  • 1
    That depends on how "asset" is defined. There are a few different definitions depending on context.
    – schroeder ♦
    Sep 18, 2020 at 17:25

1 Answer 1

Reset to default
1

Conceptually speaking, no. An "asset" is a thing that has intrinsic value. Controls have no intrinsic value; they have extrinsic value. They have value in that they protect assets.

However, depending on your context and your scope, controls can be considered assets if they are deemed to have intrinsic value. If you are assessing a control environment, then yes, keys are an asset.

Whenever performing a risk assessment, you also need to keep your scope and context clear and not start folding the scope in on itself, else everything is an asset.

Improve this answer
2
  • By "control environment" do you mean, for example, a key management server, who's function itself is actually keeping the keys secure, then they would have "intrinsic" value and be assets in turn?
    – smoothware
    Sep 18, 2020 at 19:01
  • If I may, I'd also like to extend the question. Assume you have a system performing some function. Would you say defining the function itself as an asset is better, or would you define the underlying parts of the system which fulfill the function as assets (like the firmware, configuration data, communication/messages, ...), e.g. mobile weather station - is the asset "Weather data recording function", or rather "Firmware/Software, transmitted weather data, temperature sensor, ...)
    – smoothware
    Sep 18, 2020 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.