Identifying and Classifying Information and Assets

There is a saying that’s long been popular in cybersecurity that highlights the importance of building a comprehensive digital asset inventory: “You cannot protect what you do not know that you have.” The problem with digital assets is that they are usually intangible; you cannot see or physically touch them. It can be challenging to explain to stakeholders that they must expend resources to protect intangible assets. In order to properly inventory digital assets, you must first understand the organization, the digital assets it relies upon, how they are used, and where they are stored. This is a concept covered in Chapter 3, Security Policies and Business Continuity in the previous domain under Business Impact Analysis (BIA).

This brings us to a very important aspect, which is the distinction between data and information. To grasp this distinction, consider the old saying, “Data is just ones and zeros...