Question

If you were given a list of assets, how would you define the high value assets? What elements would you consider make-up a high value asset? Can a high value asset have known vulnerabilities and still be protected, such as running Windows XP?

Answer 1

There are many factors which can define the high value asset. Infact there is a trade-off among the attributes to catagorize it a high value asset.

For example, for some system a high value asset can be a asset with more cost and at the same time for other system a high value asset can be an asset which have more value/impact on the overall system.

Let us take an example of 2 OS, Windows XP and Unix so for normal PC user Window XP can be high value asset if they consider the efficiency and ease to use as the key attribute to define the value of the asset, whereas some enterprise user or organization who consider reliability as main attribute to define the asset value then Unix becomes the high value asset. So its a trade-off.

Yes, a high value asset can have known vulnarability but still be protected such as XP. XP is vulnarable to attacks but still user can protect from such threats. High risk reduction management techniques should be adobpted to minimize such vulnarabilities.

Please let me know if more explanation is needed.