- Chapter 1: Resource Inventory
- Assigning Ownership
- Determining Value
- Security Classification
Determining Value
Determining the value of information assets is pivotal to determining the appropriate level of security. Assets may have an obvious tangible value, such as their purchase price, or an intangible value assigned to them by their owner or creator. The asset owner defines how the value of the asset is to be determined. Identifying the value of an asset is required to understand the possible loss and the appropriate level of security required.
This value is composed of the cost of creating or acquiring the information and the business impact if the information is lost or compromised. The business impact is an estimate of the degree of harm from both short-term and long-term consequences. Long-term consequences are usually more financially significant than short-term. They can include loss of business, violations of privacy, injury, and death.
It is important to evaluate the cost of creating the information, the cost of re-creating the information, and the loss to the company if the information is disclosed to determine the value of the information.
Cost of Re-creation
What was the cost in time - man and machine hours - to collect, enter, and correlate the information? This is often the cost basis for information that is collected from real-time data collection systems. The data collected from nuclear tests or space probes is extremely expensive to create and may be impossible to re-create.
Information with a high cost of re-creation needs adequate protection to avoid the destruction of the information, usually by using redundant storage of information. The cost of recovering the information may be reduced though appropriate backup and recovery procedures. However, the value of the information does not change because of good backup and recovery practices. If it took millions of dollars to create the information archive, the information is not worth less because the cost of recovering the information from backups is less. This is different from the physical world, where the value of an asset is often based on the cost to repair or restore the asset and not necessarily the cost to re-create the item.
Cost of Unavailability
Many businesses, such as financial trading organizations, depend on rapid access to their information resources. The inability to access information to make decisions rapidly can have enormous financial effects on the organization. It can even be life threatening to individuals, as in the case of medical monitoring systems.
Unavailability is a slippery subject, since the cost of the information being unavailable is very dependent on timing, duration, and situation. For example, the information needed to shut down a nuclear power plant and avoid a nuclear meltdown may not be needed for years. However, if it is unavailable at the moment that the reactor needs to be shut down, the cost of unavailability is enormous.
Security often focuses on worst case scenarios. Typical scenarios must also be considered. The frequency, and the duration of critical needs, must be evaluated for business decisions. The "one in a million" scenario must be considered; however, the financial picture may require implementation for only the typical scenario.
Systems for which availability is of prime importance require a high level of redundancy to eliminate points of failure - not to protect the information, but rather to protect the access to the information.
Cost of Disclosure
The level of information detail will affect the cost of disclosure. The more detailed the information, the more costly a disclosure will be.
Information whose public disclosure would have drastic consequences will have a high security classification, which will in itself help define what precautions are necessary. However, there are two issues with the cost of disclosure. The first is with proprietary information, where the disclosure of this information will cause the business to lose sales, market position, or some advantage. Disclosure of proprietary information has a direct effect on the business' ability to continue to conduct business in a profitable manner. It goes straight to the bottom line of the organization. The second issue is private information about individuals with which the company is entrusted. These individuals may be employees, customers, patients or partners. Disclosure of private information has an impact on both the individual, who the information is about, and the company, who is its caretaker. The organization can suffer indirect damages through a loss of confidence and through legal actions taken by those individuals who suffered because of the disclosure.
When it comes to the level of secrecy or cost of disclosure, most information often has a life cycle. In the area of planning, whether it is marketing plans or military plans, the longer in the future the information relates to, the higher the cost of disclosure. Plans that will become public tomorrow may not cause the same level of damage as plans that cover the next three to five years. The security classification of information needs to be periodically reviewed and reevaluated. Information security reclassification is a regular part of maintaining appropriate information security.