Information Technology Reference
In-Depth Information
based on the business function it pro-
vides or the results it produces. The
intrinsic value of the asset may be seven
or eight thousand dollars. However, the
business value of the asset is in terms
of the amount of revenue generation it
supports, which could easily be in the
hundreds of thousands of dollars per
day.
Key assets
have an immediate and
significant effect on revenue or costs.
Support assets
, although still important, do not
have an immediate and significant effect on revenue or costs.
Assign risk mitigation resources to risks with the highest combined probabilities
of immediacy and asset value according to the risk priority matrix (Figure 5.5).
Figure 5.5 contains assets A, B, C, and D, each with a degree of vulnerabil-
ity. The placement of these assets represents the combination of asset value, asset
vulnerability, and threat probability against that asset. For example, asset C is the
main headquarters building. The value of the asset is high in both structure and
land value. The threat probability is relatively low given its location in the suburban
United States. A similar location in an urban Middle East city may have a higher
threat probability because of civil disturbance and civil infrastructure (roads, fire
protection, police protection, water access, etc.). Asset B represents the E-com-
merce service that generates 40 percent of revenue. The asset's intrinsic value is
moderate but its business value is very high. The organization is well known, there
is public disaffection toward it, and a high probability threat level. Moreover, the
Asset Value
Intrinsic Value
Business Value
Key Asset
Support
Asset
Figure 5.4
Asset alue attributes.
Low
Vulnerability
High
High
B
D
A
C
Low
Asset Value (Intrinsic plus business)
High
Figure 5.5
risk priority matrix.
