Assessing and Managing Security Risk in IT Systems

3: INFORMATION AS AN ASSET

INTRODUCTION

The art and science of security requires a complete understanding of the value of the assets requiring protection. The asset under scrutiny is primarily the information transmitted, stored, and processed by the organization. Secondarily, the computer and telecommunications resources themselves require protection; a significant component of that can and will be addressed by applying of the McCumber Cube approach.

One of the simplest ways to understand what an organization values and how it then labels its information resources is to look at an example used for decades, the U.S. military. In government parlance, information value is defined by broad categories such as unclassified, sensitive, secret, and ...