Identifying Network Assets
The first step in security design is identifying the assets that must be protected, the value of the assets, and the expected cost associated with losing these assets if a security breach occurs. Network assets include hardware, software, applications, and data. Less obvious, but still important, are intellectual property, trade secrets, and a company's reputation.
Consider the possibility of a hacker damaging an enterprise's reputation by changing the enterprise's public web pages. You may have read about some of the cases of hackers changing U.S. government web pages. These security breaches affected the government's reputation in two ways: The changed web pages had silly graphics and text, and the government lost credibility because it appeared that it was easy to
hack into government networks.
The data that a company uses to achieve its mission is an often-overlooked asset. Data can include engineering blueprints, financial planning documents, customer relations information, competitive analysis documents, configuration information for hardware and software, employee Social Security numbers, employee badge information, and so on. The integrity and confidentiality of this data must be protected from hackers.
Some of the most important network assets are the networking devices themselves, including servers, switches and routers, and especially the firewalls and intrusion detection systems (IDSs) that provide security services to network users. These devices are attractive targets to hackers and must be hardened (strengthened) against intrusions. As Chapter 8 discusses in more detail, hardening network devices involves running only the minimal necessary services, establishing trust only with authenticated partners, using secure device management channels, and patching the device software to install fixes for known security problems.
You should consider more than just data and devices when identifying assets. The network user's time can be considered an asset. Whenever a virus attacks a system, it takes time to get rid of it, even if it's innocuous. The fact that this time is wasted is similar to a denial-of-service attack. An asset may also be the capability to offer services to customers. This is especially true for Internet service providers (ISPs), but also true for many other companies that offer medical, educational, financial, and other types of services.
Every design customer has different business assets and varying needs regarding the importance of assets. As a network designer, you should work with technical and business managers to identify which assets are critical to a business' mission. A financial services business, for example, has different assets than a health organization or a biomedical research com pany. As part of the first step of network design, analyzing business requirements, you should have developed a good understanding of your network design customer's overall business mission (which may be different from the corporate mission statement, by the way, which is often written in a lofty manner to motivate employees and impress shareholders).
Continue reading here: Adaptability
Was this article helpful?