Cyber Strategy Management – 1D. Review threat landscape (2/5)

Identify crown jewels

Your threat landscape assessment begins by identifying your organization’s assets that require protection from potential threats. However, conducting a strategic-level review for all assets is not feasible or efficient, as it can take time and effort. So, instead, you can focus on the crown jewels.

Crown jewels refer to your mission-critical information assets, distinguished by their value and potential impact if compromised. Depending on your industry and business model, these could include strategic plans, client data, proprietary source code, research results, product formulas, or trade secrets. Compromising these assets could severely affect your company’s competitive advantage, revenue streams, and reputation or lead to serious regulatory actions.

Focusing on the crown jewels lets you identify your organization’s most significant cybersecurity risks. These risks stem from the potential impact and likelihood of threat events, with the risk increasing with the impact. The most substantial impacts occur when vital assets are affected.

If you already have an inventory of your crown jewels, use it for your threat landscape assessment. If not, follow the steps below to create one.

Identify potential crown jewels

ISO 27005 identifies two types of assets: primary (business processes and information) and supporting (hardware, software, network, personnel, site, and organizational structure). IRAM2 distinguishes between business information assets and technology information assets. Both approaches can yield similar results.

To identify potential crown jewels, follow these steps:

Create a list for the assets. Create the Assets table that will contain essential information about your information assets. Include columns for:

Identify business processes. Identify your mission-critical business processes. Review your business model, Business Impact Assessment results, and available process documentation, or interview relevant stakeholders.

Identify information assets. From identified processes, recognize information assets supporting process execution. Look at process inputs and outputs. Use additional sources that may include the definition of mission-critical information assets, such as process documentation, Business Impact Assessment results or information classification policy. List unique information assets for simplicity. Fill in the Title, Description, Classification, and Key Processes columns.

Identify supporting assets. For each information asset, identify supporting assets on which it relies. Examine the information lifecycle and determine where and how the information is collected, transmitted, processed, stored, and destroyed. Focus on core assets or groups of supporting assets. Consider the following types:

Aggregate where possible. The goal is to identify potential crown jewels and understand the threats that may impact them rather than create a detailed inventory. Therefore, the level of granularity should be relatively low. When considering supporting assets like physical devices, infrastructure, people, or organization, operating in terms of asset groups or categories is more reasonable than single assets.

Assess business value

For each potential crown jewel, assess its value for the business. The ISO 27005 standard outlines various asset valuation approaches, but ISF offers a more straightforward method in their “ISF Protecting the Crown Jewels – Implementation Guide” report.

ISF suggests analyzing the extent to which each asset supports your business in categories such as Financial, Operational, Legal and Regulatory Compliance, Reputational and Health and Safety. However, depending on the business model, you need to decide which categories are best for your organization. For example, I often used the Financial, Customer, Regulatory and Reputational categories.

For each of these, you can define a set of questions to assess the asset value in each category, such as:

• Financial: To what extent does the asset support the business revenue?
• Customer: To what extent does the asset support the customer journey?
• Regulatory: To what extent does the asset support our regulatory compliance?
• Reputational: To what extent does the asset support our brand identity?

After answering these questions, assign an asset value rating for each category using a preferred rating scale. For threat landscape assessment, consider using a simple qualitative scale (e.g., 1 – Very Low, 2 – Low, 3 – Medium, 4 – High, 5 – Very High). Quantitative approaches may be too time-consuming for this task.

The highest rating usually dictates the overall asset value. However, some frameworks may propose a different approach. Record this rating in the Asset Value column of your Assets table. Granular ratings for each category are not necessary for cybersecurity strategy development.

Upon completing this activity, each information asset in your Assets table should have an asset value rating.

Assess business impact

Next, evaluate the business impact level for each potential crown jewel if a compromise occurs, focusing on confidentiality, integrity, and availability. You do not have to consider the threats causing the impact at this stage, as you will evaluate them later. Similarly, focus on the inherent risk impact, leaving out the mitigating controls for now.

Use a qualitative rating scale for the impact rating. Apply the same assessment categories as you did during the value assessment but shift your approach slightly. Instead of gauging the asset’s importance to your organization, examine the consequences of risk materialization.

Many organizations use a risk impact matrix that outlines the impact across predefined categories at various levels. Here is a partial example to illustrate the concept:

Agree on an impact rating for each category with the selected scale, ideally assessing this rating for three information attributes: Confidentiality, Integrity, and Availability. Record these ratings in your Assets table under the Impact – Confidentiality, Impact – Integrity, and Impact – Availability columns. Then, enter the highest of the three assessments in the Impact – Overall column as the overall impact rating.

Your Assets table should now include an impact rating for each information asset, which you can use later in the process.

Select crown jewels

To identify the crown jewels, you can use a simple matrix that considers asset value and impact rating, as shown in the following example:

Assets in the matrix’s top right section typically represent your crown jewels. They have a “5 – Very High” (VH) criticality rating in the example.

This activity should yield a list of your assets, highlighting the crown jewels and providing supporting information.

For a more in-depth exploration of identifying and securing organizational crown jewels, you might want to read the “Protecting the Crown Jewels – How to Secure Mission-Critical Information Assets” and “Protecting the Crown Jewels – Implementation Guide” reports, both published by the Information Security Forum.