Asset (computer security)

<h2 id="the-cia-triad">The CIA triad</h2>
<p>The goal of <a href="/facts/Information_security/horlrCln">information security</a> is to ensure the <a href="/facts/Confidentiality/JFMubsQm">confidentiality</a>, <a href="/facts/Integrity/2JwWgnvN">integrity</a> and <a href="/facts/Availability/l8SGSyyf">availability</a> (CIA) of assets from various <a href="/facts/Threat_(computer)/5RHTbSac">threats</a>.  For example, a <a href="/facts/Security_hacker/4bAJ9F1A">hacker</a> might <a href="/facts/Attack_(computing)/6PSQzq7y">attack</a> a system in order to steal credit card numbers by <a href="/facts/Exploit_(computer_security)/EdlqsRJM">exploiting</a> a <a href="/facts/Vulnerability_(computing)/jg0Gr71M">vulnerability</a>. Information Security experts must assess the likely impact of an attack and employ appropriate <a href="/facts/Countermeasure_(computer)/t1hYzsGy">countermeasures</a>.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a>  In this case they might put up a <a href="/facts/Firewall_(computing)/Et2RkJaU">firewall</a> and <a href="/facts/Encrypt/16q29Fdv">encrypt</a> their credit card numbers.
</p>
<h2 id="risk-analysis">Risk analysis</h2>
<p>When performing <a href="/facts/IT_risk_management/kWCL78DK">risk assessment</a>, it is important to weigh how much to spend protecting each asset against the cost of losing the asset. It is also important to take into account the chance of each loss occurring.  Intangible costs must also be factored in.  If a hacker makes a copy of all a company's credit card numbers it does not cost them anything directly but the loss in fines and reputation can be enormous.
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Countermeasure_(computer)/t1hYzsGy">Countermeasure (computer)</a></li>
<li><a href="/facts/Factor_analysis_of_information_risk/BBuJ011B">Factor analysis of information risk</a></li>
<li><a href="/facts/Information_security_management/IPGKqwdh">Information security management</a></li>
<li><a href="/facts/IT_risk/ypuDa6CL">IT risk</a></li>
<li><a href="/facts/Risk_factor_(computing)/6B8qhWTp">Risk factor</a></li>
<li><a href="/facts/Risk_management/xGhxtxdp">Risk management</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://web.archive.org/web/20110726055502/http://fismapedia.org/index.php?title=Term%3AAsset">FISMApedia TERM</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"ISO/IEC 27005:2022 - Information security, cybersecurity and privacy protection". ISO. October 2022. Retrieved 31 December 2023. <a href="https://www.iso.org/standard/80585.html" target="_blank">https://www.iso.org/standard/80585.html</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>"ENISA Glossary". Archived from the original on 2012-02-29. Retrieved 2010-11-21. <a href="https://web.archive.org/web/20120229151151/http://www.enisa.europa.eu/act/rm/cr/risk-management-inventory/glossary/#G3" target="_blank">https://web.archive.org/web/20120229151151/http://www.enisa.europa.eu/act/rm/cr/risk-management-inventory/glossary/#G3</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>"An Introduction to Factor Analysis of Information Risk (FAIR)", Risk Management Insight LLC, November 2006 Archived 2014-11-18 at the Wayback Machine; <a href="http://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf" target="_blank">http://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>IETF RFC 2828 <a href="/wiki/RFC_(identifier)" target="_blank">/wiki/RFC_(identifier)</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
</ol>

Asset (computer security) open-in-new

Asset (computer security)