How to Identify an Asset Threat

Managing your risk can reduce asset theft possibilities for your company or organization.

Asset threats need to be identified and then managed so they don't become vulnerable and threatened by people looking to do your company or organization harm. The key elements that lead up to the threat to an asset are motivation, capability and intent. The motivation and intent cannot be controlled by the person looking to protect the asset. However, understanding and strengthening your vulnerabilities can limit the capabilities of a person looking to steal the assets your company or organization is working to protect.

Instructions

Procedure

1. Identify Security objectives to make it easier to identify threats to your assets and to develop strong safeguards. Note the weaknesses in systems or internal controls.

2. Create an asset threat overview. Discuss possible scenarios where assets might be compromised. Think about the people that would want the assets in your possession. Determine their uses for the thief and how they would be able to obtain them. Understanding how the potential thief might obtain the assets you want to protect will help identify the threat and ways to safeguard your assets.

3. Identify breakdowns in the system that could cause asset theft. Identify the most valuable assets and determine how they would be compromised. Work to limit the access points and exit points; examine how the data is accessed, shared and used by your company. Determine the level of trust placed in employees and determine what each person can access. This will identify the potential threat and limit the number of people who can access the asset.

4. List the threats. Determine where they are. Explain the problems in detail and be honest about what compromises to that data will mean. These threats also should look at possible motives and intents of the potential asset thief.

5. Identify vulnerabilities in current asset protection. An important outcome of listing the identified asset threats is then determining asset protection system vulnerabilities. As these assets are listed and evaluated for value and potential damage for your company or organization, identify the vulnerabilities. If one asset is more vulnerable than the others and a thief can identify this, they will be more apt to strike at the asset they can most easily steal, even if it is not the most valuable asset to your company or organization.

Tips & Warnings

• Create a diverse group of people when identifying asset threats. People with different ideas and perspectives will give your company or organization a complete overview of the asset threats and will build an effective plan to manage those threats.

• Make sure that one employee does not have too much control over the system that safeguards the assets. Even an employee who is considered your most trusted worker, if given the opportunity or ability to commit asset theft, might make an attempt.

References

• Microsoft At a Glance: Web Application Threat Modeling
• Windows Security: Threats and Your Assets
• Strategic Security Management: A Risk Assessment Guide for Decision Makers