Attack Surface Management

Chapter 6. Prioritization and Crown Jewel Analysis

Prioritization in attack surface management builds on the inventory a company has already taken to determine an order to how assets will be secured. This involves looking holistically at how various aspects fit into the overall business ecosystem and assessing the value they provide. As part of the holistic look, many stakeholders across the organization will need to be engaged to help provide the context to critically evaluate different prioritization levels. 

This chapter will investigate the wide range of criteria for making these prioritization determinations. 

Understanding Prioritization

Prioritization is how ASM determines what resources require the most protection. It does this by systematically determining the relative importance of various assets so that resources can be allocated effectively. The process encompasses a wide range of assets, including the physical (e.g., machinery, buildings), the digital (e.g., data, software), and intellectual properties (e.g., patents, trademarks). It takes into account the full scope of these assets to ensure that all facets of an organization’s infrastructure are considered.

The primary goals of asset prioritization are to enhance security, improve resource allocation, and ensure operational continuity. By identifying and focusing on the most critical assets, organizations can strengthen their security posture against potential threats. 

Effective prioritization also aids in better ...