The IT and OT asset inventory includes assets within the function that may be leveraged to achieve a threat objective
Context and Guidance: Assets within the function are those that the organisation considers as the potential target of the tactics or goals of a threat actor. When considering assets that should be given this designation it is helpful to consider assets that a threat actor might use to accomplish their end-goal, such as • public-facing assets that may serve as an initial access point • individual assets that would allow lateral movement within an organisation’s network • assets with administrative rights that would enable privilege escalation Note that identification of this set of assets should be based on an assessment of risk and could be informed by an understanding of the organisation’s exposure to threats and vulnerabilities, to the extent that these are known.
A threat objective describes the potential action or tactic of a threat actor to achieve a particular outcome or goal by leveraging the assets within the function. The outcome or goal of the threat objective is to negatively impact the organisation. Threat objective examples may include data manipulation, IP Theft, damage to property, denial of control, loss of safety, or operational outage. A threat profile for an asset may include one or more threat objectives which may change over time or in different situations. Threat objectives are contextual to the organisation and the assets within the function. For example, an organisation that does not process confidential data may not be concerned about data theft but may be very concerned about an incident that causes an operational outage. Additionally, threat actors may leverage multiple tactics or techniques like those defined in the MITRE ATT&CK frameworks (for Enterprise or Industrial Control Systems) to achieve their goals. Knowledge of potential threat actors, their threat objectives, and the tools and tactics they may use to achieve their goals should inform the identification of assets within the function.
Related Practices • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ASSET-1a, ASSET-1b, ASSET-1f, ASSET-1g.