Asset Valuation Method for Dependent Entities
Jakub Breier · DR-NTU (Nanyang Technological University) · 2014
Asset analysis and valuation are important parts of the information security risk management. Outputs they produce are used in the process of risk analysis that plays a key role in securing organi-zation's business processes. A correct analysis and valuation of assets should reveal not only their importance for the organization, but also their relationships and dependencies between each other. There is a lack of works considering asset dependencies for the risk management purposes, this part is usually left for a subjective perception of a risk analyst, who should adjust the risk values in the end. In our work we propose a systematic approach for including asset dependencies in the asset valuation process. We inspect the relations between assets from the common security attributes point of view-confidentiality, integrity and availability. Our method should help to formalize the problem with dependent entities in the organization's model.