Identify
Michael Melone · 2021
Creation of a secure system begins by identifying what it is the readers want to secure. The natural desire is to say that everything is important, but with limited resources available for security we must be diligent about identifying exactly how valuable everything is – and from what perspective. There are three main aspects of a system to consider when designing a classification system, namely data, services, and principals. Each will require a different approach, and in many cases, a different classification scheme. Most classification schemas leverage a label-based system. These systems identify assets based on their potential impact to the organization, either directly or indirectly. One common way to measure risk leverages a financial model to determine the estimated cost if the organization were to lose security over an asset. While subjective, this approach is very effective in describing security risk to leadership.