CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)       9  5.7  Risk Identification

5.7  Risk Identification 1 5.7.2  Risk Assessment

Before you can analyze risks, you need to know what you have to lose. In order to know that, you have to identify your organization’s assets.

Assets can be physical (or tangible) or intangible. In the physical world, Asset Identification can involve tagging each physical asset with a physical label (frequently with a bar code) or a tag with RFID (Radio Frequency IDentification) that derives its power from the reader, therefore not requiring a power source at the tag (which is how the exits work at some retail stores).

It is useful for inventory purposes to tag each asset with a unique number. The unique ID number makes it easy to maintain a database listing each asset, purchase information, description and location. Particularly when bar-code or electronic tags are used, asset tagging simplifies the process of conducting a periodic inventory of assets, where teams of asset control personnel manually go through an office recording the assets located there. Generally the value of physical assets can be estimated, often by starting with the item’s purchase price and then applying depreciation rules.

Intangible assets include information (such as the contents of databases), company goodwill and reputation (which might be damaged by an extended web site outage or defacement), etc. It may be difficult or impossible to accurately identify the value of intangible assets.

An important thing to note about assets of an “information age” company filled with knowledge workers is that the intangible information stored on a server may have a value far exceeding the value of the physical server itself. This is almost certainly the case in any software company and many e-commerce companies as well.

5.7  Risk Identification 1 5.7.2  Risk Assessment