Focus on Information Assets Rather than Data Elements

When asked about prioritizing information assets, many CISOs will say they have a data classification program. That means they have a team going through every field in every database and categorizing each one as “restricted,” “confidential,” “internal,” or “public”—typically over the course of two to three years. This type of approach is great in theory, but in practice it often excludes important unstructured data that live outside databases; and attackers are unlikely to wait politely for three years while a company finishes its classification program. To address the full set of data and derive a set of insights they can act on, cybersecurity teams need to start at a higher level of abstraction and look at information assets rather than fields or tables in databases.

An information asset is a coherent body of information that has recognizable and manageable business value and that is defined by business needs and objectives rather than the specifics of how and where it is stored. As noted earlier, it is not a system, a database, or an application. It could be customer information for a consumer auto business, business plans for upcoming mobile products, or manufacturing specifications for paint application. The assets will vary by business, and the importance of different types of assets will also vary.

There is no hard-and-fast rule about the right level of granularity for an information asset—for example, should manufacturing specifications for 10 different products in a given business unit be treated as 1 information asset or 10? That said, there are two heuristics for answering such questions: materiality and distinction. Which of the products are big enough to matter? Are there enough business differences among the products so their manufacturing specifications will have different levels of sensitivity?

Typically, a business will have between 25 and about 80 information assets, depending on its size and complexity. Table 3.1 shows a typical list of assets for an insurance company.

Assess Business Risks, Not Technology Risks

When we ask a CISO what risks he is worried about at the moment, he is likely to say, “Ten percent of our servers are running on an operating system that’s about to go off support. Our network is almost entirely flat, so I can’t slow down attackers once they get in. And did I mention our developers’ buggy insecure code?” These are all incredibly important vulnerabilities that almost certainly need to be addressed, but in what order? And which applications with buggy, insecure code should be tackled first? It is impossible to answer this without having a sense of what information assets the application might use, who the attackers might be, and what business harm could result.

A business risk is the combination of:

• A valuable information asset (e.g., personal health information, a manufacturing process for a new product)
• An attacker (e.g., organized cyber-criminals, state-sponsored actor)
• A business impact (e.g., regulatory or legal exposure, industrial espionage)

A business risk for a health care provider therefore might be regulatory and legal exposure as a result of cyber-criminals stealing patient medical data. For a technology provider, it might be the loss of competitive advantage after a state-sponsored attacker steals a manufacturing process and sells it to a competitor.

Companies find it much easier to think about impact and likelihood in terms of business risks than for technology risks or vulnerabilities. Perhaps more importantly, senior executives find business risks to be a tangible way to engage on cybersecurity.

Start with a Hypothesis

When CISOs ask senior business leaders what cybersecurity risks worry them, they seldom receive deep, thoughtful answers based on underlying business drivers. More commonly, the answers are along the lines of “I hadn’t really thought about that” or “Customer information is most important, I guess.” Answers like these highlight why the cybersecurity team cannot just listen and record the business perspective—it must develop its own hypotheses and engage business leaders as peers.

Use Value Chain and Risk Classification

A business value chain identifies each step in important processes. In insurance, for example, these would be origination, underwriting, servicing, and claims. For each step, a classification of business risks reveals important questions to ask:

• Are there data associated with this step in the value chain that would cause reputational damage if publically exposed?
• What IP does this step use that might be valuable to competitors?
• What sensitive business information could be disclosed about this step?
• What are the opportunities for cyber-fraud?
• What is the potential for business disruption or data corruption?
• What regulatory actions could occur?

This exercise helps the cybersecurity team develop a first view on what business risks and information assets it needs to raise with business leaders. It also helps ensure that important issues are not missed in the process. Figure 3.1 shows how this mapping clearly flags the priority risks.

Ground Discussions in Underlying Business Drivers

The question of which risks to which information assets matter most has to be based on underlying business drivers such as scale, share, growth, and competitive position.

For example, one manufacturing company struggled to differentiate the risk of IP being compromised for different products until it started to look at these products’ revenues, margin, and growth. For the first cut, business managers suggested taking a product life-cycle view. Some of the potentially most valuable IP was for new products that had yet to catch on in the market. This led to a discussion about which product value propositions most depended on IP. Ultimately, the cybersecurity team developed a perspective on which IP was most valuable to the company in terms of growth and margins over the coming years.

Taking a similar business perspective also helped a financial institution clarify the value of its pricing information. Many of its businesses said that their pricing information and databases were highly proprietary and that they worried about employees taking copies when they left to work for competitors. However, the markets for some financial products are very liquid, with highly transparent market prices. Other markets are less liquid and prices vary quite a lot. The less liquid the market, the more valuable the pricing data is as an information asset and the greater priority it needs.

Remember that the Enemy Gets a Vote

Any discussion of business risks has to include a perspective on whether there is a credible attacker with the capabilities and motivation to compromise and exploit an information asset. If a company has a valuable piece of IP that it has invested hundreds of millions of dollars developing, then this is clearly a valuable information asset, but that does not necessarily mean that there is a large business risk associated with it. The cybersecurity team has to talk to business managers to find out whether executives at traditional competitors would be willing to commission a cyber-attack to steal the IP and risk exposure and prosecution to pick up a few points of market share. A competitor from another country might be more aggressive if it were less likely to be prosecuted, but cybersecurity teams and business managers must then consider whether it would have the expertise to take advantage of the IP within a reasonable time frame?

Use Pragmatic and Transparent Decision-Making Criteria

Nobody has yet developed a robust, usable, generally applicable model for the expected economic impact of different types of cyber-attacks. However, that does not mean companies should make cybersecurity investment and policy decisions based purely on subjective inputs.

A scorecard-based approach provides a workable mix of feasibility and rigor. For any given business risk, the impact can be scored in terms of the company’s reputation, competitive position, economic losses, and regulatory impact. For example, a financial impact of less than $100 million might be considered low impact; between $100 million and $1 billion medium impact, and anything more than $1 billion high impact. From a reputational standpoint, a breach likely to be reported only in trade publications would be low impact, but one that might reach the front page of regional or national newspapers would be high impact. In terms of regulation, a low-impact event might result in regulatory inquiries but no findings, a medium impact event may have findings but a clear path to remediation, while a high-impact event would be one with a substantial negative impact on a company’s relationship with the regulator.

Alongside impact, cybersecurity teams can score the likelihood of an attack as low, medium, or high in terms of:

• User exposure: Number and type of users who have access to the system (e.g., internal users only, suppliers, customers, semipublic, public).
• System exposure: Number and type of systems on which an information asset sits or passes through.
• Vulnerability: Quality and extent of existing controls.
• Attacker: Value to potential attackers and the capabilities of likely attackers.

Using these criteria, companies can stratify risks according to expected impact (Figure 3.2). Done well, this can have a transformational impact. Broad alignment on the most important business risks can shape every cybersecurity decision, from how to structure the organization to where to deploy resources and which technologies to invest in. Even more directly, more stringent controls can be put in place to protect the most important information assets where the business risk is considered critical.

Step 1: Identify Assets across the Value Chain

The group’s first task would be to discover what the critical information assets were. The team would look at the business processes that occurred along the value chain—product development, marketing, sales, and after-sales service—and develop a set of hypotheses about the important information assets at each step. At that point, the CISO would sit down with senior executives from each business area and rather than just ask what keeps them awake at night, he would test the hypotheses his team developed and use them to get a better understanding of which information assets might be most important.

For example, the head of sales might explain that the company gets incredibly sensitive forecasts and specifications from its auto manufacturer customers as part of the process of bidding to supply a subsystem for a new vehicle under development. If the manufacturer believed that such information could be compromised, the impact on the supplier would be devastating from a business standpoint. By contrast, sales forecasts related to models already in production might be much less sensitive because competitors could already estimate this from existing publicly available projections.

Step 2: Analyze the Risk and Prioritize the Assets

The company would now have a good list of important information assets but would not yet understand the risks. Based on their discussions with business leaders, the CISO and his team would ask themselves about the impact on the confidentiality, integrity, and availability of each information asset should it be compromised. They would score each combination of compromise and asset in terms of competitive disadvantage, customer impact, reputation impact, fraud loss, regulatory exposure, and legal exposure. This would take into account issues such as the underlying product economics and competitive pressures (e.g., the impact of losing IP underpinning a marginal product might be quite low).

They would now take the attackers’ perspective and try to understand who would benefit from compromising important information assets and whether those who would benefit have both the incentives and the capabilities to act on any information they extract. A traditional competitor would benefit from understanding a company’s manufacturing processes, but executives might not be willing to risk destroying their careers and forfeiting their freedom to take advantage of that information now. A new market entrant might be less worried about prosecution but might lack the expertise to take advantage of sophisticated manufacturing techniques. The CISO and his team would also know that not all attackers are external and that insiders often take sensitive product and pricing information with them when they start jobs at competitors, which they also need to factor into their decisions. The team would complement this attackers’ view with high-level perspectives on the current level of exposure. For each asset, they would ask how many people have access to it and whether it has already been targeted for more restrictive controls.

Based on this analysis and a structured set of criteria, the team would now have a prioritized list of information assets. These would likely be stratified into a few categories, for example, crown jewels, restricted data, baseline data, and public data. It could also synthesize a prioritized list of business risks stratified by business impact and likelihood. Both would be invaluable in communicating its findings with business leaders. The team would conduct one or more workshops with its partners in the business to test its findings and reprioritize the risks and information assets as required.

Step 1: Evaluate Current Level of Protection

The team cannot apply protections directly to information assets, so they would need to determine which systems house priority information assets and what protections were already in place on those systems.

First, it would define three or four levels of rigor for each major type of control—I&AM, data protection, DLP and digital rights management (DRM), application security, infrastructure security, network security, vendor management, and others. Then it could launch a survey of application development managers asking them to map the priority information assets to systems and to score each system in terms of the rigor of each type of control applied.

This would enable the CISO to answer several important questions, such as:

• How rigorous is each type of control (e.g., do most applications use single-factor or dual-factor authentication?)
• Are the most important information assets protected by more rigorous controls?
• What drives choices about controls—do some parts of IT use more rigorous controls, regardless of whether the system houses the most sensitive information assets?

Step 2: Define Future Protection Levels

Four levels of rigor, even for only six control areas, would result in more than 4,000 distinct control combinations. Therefore, the CISO and his team would need to create bundles of controls.

If they wanted to be very simple, they would define one bundle of controls for the crown jewels—the company’s most important information assets—one for restricted information, one that would be for the baseline, and one for public or less important data. However, they might decide to have variations of each bundle for structured data (e.g., customer order history and other information found in databases) and unstructured data (e.g., proposals and other data stored in documents). In defining the bundles, the CISO would use existing technologies and capabilities as much as possible but might conclude that some new capabilities are required (e.g., out-of-band authentication). In all cases, the team would assess the effect of each bundle of controls to ensure that any additional impact on user experience made sense in the context of reducing the risk, and then validate this using focus groups, demos, and other techniques.

Finally, the team would use the classification of information assets and the mapping of information assets to systems to define which bundle of controls needs to be applied to which system.

Step 3: Transition to Implementation

Once the CISO has identified the optimum levels of protection, his team needs to assess what they and others have to do to put these controls in place. In some cases, the change will be a simple policy or process change—vendors that handle a certain type of information asset will need a more thorough assessment; passwords for applications that house a certain type of information asset will need to be changed more frequently.

In many cases, the company will already have the underlying security capability, but a system might need to be adjusted to adopt it. The company might have tools that support multifactor authentication, for example, but many systems may need enhancing so they can use the company’s latest I&AM platform.

There may be cases where the CISO needs to launch or accelerate the introduction of a new technology or capability. For example, the company might need to implement DRM in order to control who can access documents with data such as product road maps and manufacturing specifications. Therefore, the team would build all the implementation activities into its work plan for the coming year and those of many of its partner organizations.

Finally, the CISO and his team would make sure that they had a documented methodology for prioritizing information assets and putting differentiated controls in place so they could easily repeat the process, reflecting changing business conditions, an evolving attacker environment, and new innovations in defense mechanisms.

● ● ●

Any company, no matter its size or complexity, will have many different types of information assets and face a bewildering array of business risks. No company can protect everything effectively, especially not at a reasonable cost and with acceptable levels of impact to the business.

Therefore, companies have to prioritize. They need to understand their most important information assets and the business risks they face, and they need to use this insight to put more rigorous business process, broader IT, and cybersecurity controls in place to protect these critical information assets.

This cannot be a one-time event. Business models change, creating new types of information assets. Attackers improve, creating new risks and heightening old ones, while state-of-the-art cybersecurity also evolves, creating new options for differentiated controls.

Companies therefore need to put in place repeatable, structured processes that allow the cybersecurity team to engage with the business leaders to discover important information assets, prioritize business risks, and align on differentiated protection. Moreover, these processes should be a critical input to the development of annual cybersecurity budgets and plans.

Input and validation from senior business leaders will be essential. The CEO must set overall expectations about risk appetite, while business unit executives must provide input on identifying information assets, assessing business risks, and validating trade-offs between the risk, cost, and business impact of the different protection options.