Theory: Organizational Assets & Vulnerabilities
Every attack story starts with a target: what does the attacker consider worth taking? For a defender, that means knowing your assets, ranking them by how much they matter, and finding the vulnerabilities that leave them exposed. This section covers the first two links of the attack chain (see 2.1).
The Target: Organizational Asset Categories
An asset is anything of value to the organization. Assets are much broader than computers:
| Category | Examples | MediCare Plus example |
|---|
| Information / Data | Records, credentials, intellectual property, customer data | Patient health records, billing data |
| Technology / Systems | Servers, applications, networks, endpoints | The EHR system, guest Wi-Fi network |
| Physical | Facilities, hardware, equipment | The data room, infusion pumps, patient monitors |
| People | Staff knowledge, skills and availability | The three-person IT team and what only they know |
| Reputation / Intangible | Trust, brand value, regulatory standing | Patients’ trust, PDPA compliance standing |
Common mistake: listing only IT equipment when asked for “assets.” Exam answers that also name people and reputation/intangibles show the managerial view this course expects.
Identifying and Prioritizing Assets
Not everything can be protected equally, so assets are handled in three steps:
- Inventory: list what the organization has: data, systems, people, facilities. You cannot protect what you don’t know you have.
- Value: ask, how much would it cost the organization if this were lost, exposed, or unavailable? (Note these three map to integrity/availability, confidentiality, and availability.)
- Prioritize: rank assets by business criticality.
Criticality = Value to the business × Sensitivity of the information
Levels, from low to high: Low → Medium → High → Critical.
- Value to the business: how much the organization depends on the asset to operate and earn (revenue, core services, safety).
- Sensitivity of the information: how much harm disclosure or alteration would cause (personal, medical, financial, legally protected data).
Because the formula multiplies, an asset scores highest only when it is both important to the business and sensitive. A public marketing website may be valuable but holds little sensitive data; an old archive of HR files may be sensitive but rarely used.
Mini-example
At MediCare Plus, the EHR is essential to daily care (very high value) and holds medical records protected by the PDPA (very high sensitivity) → Critical. The guest Wi-Fi is a convenience (low value) and carries no hospital data (low sensitivity) → Low, though, as 2.3 shows, it can still be a stepping stone to more critical assets.
Criticality based on data alone can miss safety. Networked infusion pumps hold little sensitive data, yet they are Critical because compromising their integrity or availability can directly harm a patient. Treat “value to the business” as including the safety of the people the business serves.
The Vulnerability: Three Categories
A vulnerability is a weakness that leaves the door open. The course groups vulnerabilities into three categories:
| Category | Examples |
|---|
| 1. Human / Process | Weak passwords, lack of training, poor procedures, susceptibility to social engineering, access that is never revoked, incidents that are not documented |
| 2. Technical | Unpatched systems, misconfigurations, insecure default settings, legacy software |
| 3. Physical | Unsecured facilities, unattended devices, lack of access control to hardware |
To classify a vulnerability, ask where the weakness lives:
- in people’s behavior or the organization’s procedures → Human/Process;
- in hardware, software or configuration → Technical;
- in the physical environment or physical access → Physical.
“Limited IT staff” or “no budget for security” is a Human/Process (organizational) vulnerability, not a technical one: the systems themselves aren’t flawed, but the organization lacks the capacity to look after them.
Mini-example
At MediCare Plus: the 11-year-old, heavily customized EHR (legacy software) is Technical; the phishing near-miss that was never formally documented is Human/Process; a server room door left propped open would be Physical.
Worked Examples
Exercise 1
Classify each MediCare Plus asset into one of the five asset categories: (a) patients’ trust in the hospital; (b) the billing database; (c) the senior systems administrator’s knowledge of the customized EHR; (d) the server room and its air conditioning; (e) the hospital’s network switches.
Show solution ↓Hide solution ↑
Solution
Ask what kind of thing each asset is.
- (a) Trust is intangible → Reputation / Intangible.
- (b) Records of financial and insurance data → Information / Data.
- (c) Knowledge held by a person → People.
- (d) A facility and its equipment → Physical.
- (e) Network infrastructure → Technology / Systems.
(a) Reputation/Intangible, (b) Information/Data, (c) People, (d) Physical, (e) Technology/Systems.
Exercise 2
Using Criticality = Value to the business × Sensitivity of the information, rank these university assets from most to least critical and justify: (1) the public news website, (2) the student records database, (3) the cafeteria menu app.
Show solution ↓Hide solution ↑
Solution
Rate each factor, then combine.
| Asset | Value to business | Sensitivity | Criticality |
|---|
| Student records database | High (registration, transcripts, graduation) | High (personal data, grades) | High/Critical |
| Public news website | Medium (communication, reputation) | Low (information is already public) | Medium |
| Cafeteria menu app | Low | Low | Low |
The student records database is the only asset that is high on both factors, so multiplying puts it far ahead.
Ranking: student records database > public news website > cafeteria menu app.
Exercise 3
Classify each vulnerability as Human/Process, Technical or Physical:
(a) A database server still uses the vendor’s default admin password.
(b) Staff were never trained to recognize phishing emails.
(c) Laptops are left unlocked on desks in a public waiting area.
(d) Accounts of employees who left the company are never disabled.
(e) An operating system that no longer receives security updates.
Show solution ↓Hide solution ↑
Solution
Ask where each weakness lives.
- (a) An insecure default setting in the system’s configuration → Technical.
- (b) A gap in people’s awareness → Human/Process.
- (c) Unattended devices in an uncontrolled physical space → Physical.
- (d) A missing procedure (offboarding / access revocation) → Human/Process. (The account itself is technical, but the root weakness is the process that never removes it.)
- (e) Legacy, unpatched software → Technical.
(a) Technical, (b) Human/Process, (c) Physical, (d) Human/Process, (e) Technical.
Exercise 4
A hospital’s network-connected infusion pumps store no patient-identifying data. A junior analyst rates them “Low” criticality for that reason. Do you agree? Explain.
Show solution ↓Hide solution ↑
Solution
- The analyst considered only sensitivity of information, which is indeed low.
- But value to the business includes the hospital’s core service: safe patient care. Infusion pumps deliver medication to patients.
- If an attacker altered a dose (integrity) or stopped the pumps (availability), patients could be physically harmed or killed, with severe legal and reputational consequences.
- So the business value is extremely high, and the asset’s importance comes from safety, not data.
Disagree: the pumps should be rated Critical, because compromising their integrity or availability can directly harm patients, even though they hold little sensitive data.
Exercise 5
Explain why “Inventory” must come before “Value” and “Prioritize” in asset management, using an example.
Show solution ↓Hide solution ↑
Solution
- You can only value and rank assets you know exist. Anything missing from the inventory receives no protection decisions at all.
- Example: at MediCare Plus, the new networked medical devices were installed by a vendor on a construction timeline and have not been fully reviewed by IT. If they are not on the asset inventory, nobody rates their criticality, nobody checks their configuration, and they become an unmanaged way in.
- Unknown assets (forgotten servers, “shadow IT”, vendor-installed devices) are a common source of breaches precisely because they were never inventoried.
Inventory comes first because unlisted assets cannot be valued, prioritized or protected; they become blind spots.