Wired for Safety: For organization’s cybersecurity, start with system boundary and inventory

In the last article, we looked at some ways to start the process of understanding the impact to your organization’s mission if there was a compromise or other event that caused a disruption of service. We also looked at how to start determining what information assets exist and where they reside. Let’s look at understanding our system boundary and creating a system inventory so you know the full scope of what you are dealing with. After creating an inventory of all information assets, it may help justify the need to allocate money to the budget for security services support. Organizations can grow and so can the information assets that accompany growth. However, some control is needed over what networked assets are in the organization so that critical information can be properly managed.

We cannot begin to manage the number of security threats if we don’t have a firm grasp on what we are protecting. How many organizations can really and truly count the number of networked assets they have in their organization with at least 95 percent confidence? How many know and understand their security boundary?

A security boundary contains all information assets for which an organization’s security responsibility resides. In the image below, you see a very small and simple network that has quite a simple security boundary.

Read more: Wired for Safety: For organization’s cybersecurity, start with system boundary and inventory