Do you really understand the value of the data in your organisation? Some of it is fairly straightforwards, such as personally identifiable information (PII) and/or credit card information ($188 USD per record in direct and indirect costs to the organisation for every record lost was the figure I last heard and used).
What about your intellectual property though? Or client RFP’s and and pre-sales work left on the train? Salary information? Internal network architecture diagrams? Sometimes, when this information is lost it is difficult to ascertain its value, impact to you and your organisation and therefore the scale of your response.
I was reminded of this value quandary while I was having a second fitting on a suit I was having made at the shop of Charlie Allen in Islington. Before anyone makes a judgement on my salary, the suit was a very welcome prize from my time at the InfoSecurity show in April, from the good folks at Sestus. I have had suits made before, normally in India, but this was my first suit to be made wholly in England and knew there would be a difference in price if i were to pay for it myself. After the fitting I asked to be measured up for some new shirts; I thought I would treat myself and take advantage of the time in Charlie’s studio. I checked the price of £200 with a minimum order of three. Good value I thought, three shirts for £200. It was only after the fabric selection, design, measurements etc the invoice came… The shirts were £200 each, a total of £600. I very nearly handed over my credit card simply to avoid the humiliation of admitting my mistake and exposing myself as someone who quite obviously shops in Top Man.
Blustering my apologies, I mentioned something about obviously not understanding the true value of these shirts, asked for the quote to be put on file for “later” (i.e. when I win the lottery) and made a quick exit. However, as I walked back to the office I realised that it was obviously going to be £200 each; a good quality short from Thomas Pink off the peg costs between £80 and £100 each, therefore how can three made to measure shirts cost £200? I had woefully underestimated the value of something that was actually quite obvious in hindsight.
So what? Understanding your information assets, and their value is a table stakes exercise. Doing this will allow you to do two things;
- Understand the total value of your assets and use the figure to work out what kind of exposure your organisation is likely to experience in case of a breach.
- Subsequently use this information to build a realistic business case for protective and preventative measures to avoid that breach in the first place.
- Ensure the scale of your response when those assets are compromised is commensurate to their value.
There are plenty of good resources to help guide you on this, but one of the most important pieces of the puzzle is to understand the financial value of your assets in the first place, and certainly not after a breach.