http://soup.rachner.us/ http://soup.rachner.us/ http://7.asset.soup.io/asset/0506/3271_6289.jpeg 264 273 Eric Rachner's observations on information security, hacking, and the business of IT risk and compliance. {"tags":[],"type":"regular","title":"Congratulations, Dan Kaminsky","source":null,"body":"Also, I know where you live. \u00a0\u003Ca href=\"http://www.metro.co.uk/news/836210-brit-given-a-key-to-unlock-the-internet\"\u003EOne down, four to go.\u003C/a\u003E \u00a0;) \u003Cdiv\u003E\u003Cbr /\u003E\u003C/div\u003E\u003Cdiv\u003E(Oh, wait. \u00a0The problem with these secret-sharing schemes is, you can never be sure which one gave you a bogus fragment of the key. \u00a0Back to the drawing board, I guess.)\u003C/div\u003E"} Also, I know where you live.  <a href="http://www.metro.co.uk/news/836210-brit-given-a-key-to-unlock-the-internet">One down, four to go.</a>  ;) <div><br /></div><div>(Oh, wait.  The problem with these secret-sharing schemes is, you can never be sure which one gave you a bogus fragment of the key.  Back to the drawing board, I guess.)</div>Wed, 28 Jul 2010 23:11:15 GMThttp://soup.rachner.us/post/67896508/Congratulations-Dan-Kaminskyurn:www-soup-io:1:67896508regular {"tags":["microsoft","espionage"],"type":"regular","title":"Told ya so.","source":null,"body":"\u003Cdiv\u003EWhat was I saying about spies in the workplace? \u00a0Something like,\u00a0\"\u003Ci\u003E...\u003C/i\u003E\u003Ci\u003Enot just Google, and not just in China, and not just by China.\u003C/i\u003E\"\u003C/div\u003E\u003Cdiv\u003E\u003Cbr /\u003E\u003C/div\u003E\u003Cdiv\u003ELike, perhaps, at Microsoft, in Redmond, by Russia? \u00a0From the Seattle Post-Intelligencer:\u003C/div\u003E\u003Cdiv\u003E\u003Cbr /\u003E\u003C/div\u003E\u003Cdiv\u003E\u00a0\u00a0 \u00a0\u00a0\u003Ca href=\"http://www.seattlepi.com/local/423366_russian14.html\"\u003ERedmond Man Deported as Result of Russian Spy Probe\u003C/a\u003E\u003C/div\u003E\u003Cdiv\u003E\u003Ch1 class=\"rdheadline\"\u003E\u003Cb\u003E\u003Cbr /\u003E\u003C/b\u003E\u003C/h1\u003E\u003C/div\u003E"} <div>What was I saying about spies in the workplace?  Something like, "<i>...</i><i>not just Google, and not just in China, and not just by China.</i>"</div><div><br /></div><div>Like, perhaps, at Microsoft, in Redmond, by Russia?  From the Seattle Post-Intelligencer:</div><div><br /></div><div>     <a href="http://www.seattlepi.com/local/423366_russian14.html">Redmond Man Deported as Result of Russian Spy Probe</a></div><div><h1 class="rdheadline"><b><br /></b></h1></div>Sun, 18 Jul 2010 23:24:03 GMThttp://soup.rachner.us/post/65993278/Told-ya-sourn:www-soup-io:1:65993278regularmicrosoftespionage {"tags":[],"type":"regular","title":"Thought for the Day","source":null,"body":"Just wait until Google indexes the public record."} Just wait until Google indexes the public record.Sun, 21 Mar 2010 20:08:56 GMThttp://soup.rachner.us/post/49688539/Thought-for-the-Dayurn:www-soup-io:1:49688539regular {"tags":["china","aurora","google","microsoft","offshoring","doingitwrong"],"type":"link","title":"Offshoring Partners \u0026amp; The Hand That Feeds","source":"http://mashable.com/2010/01/18/attack-google-inside-job/?utm_source=feedburner\u0026utm_medium=feed\u0026utm_campaign=Feed%3A+Mashable+%28Mashable%29","body":"\u003Ca href=\"http://mashable.com/2010/01/18/attack-google-inside-job/?utm_source=feedburner\u0026amp;utm_medium=feed\u0026amp;utm_campaign=Feed%3A+Mashable+%28Mashable%29\"\u003EPeople are catching on\u003C/a\u003E to what the \u003Ca href=\"http://lists.immunitysec.com/pipermail/dailydave/2010-January/005995.html\"\u003Esmart kids knew\u003C/a\u003E all along: \u003Cem\u003Eof course\u003C/em\u003E Google's Chinese offices were compromised.\u00a0 And not just Google, and not just in China, and not just by China.\u003Cbr /\u003E\u003Cbr /\u003ETen years ago, the disloyal insider was a fact of life about which there wasn't much to be done.\u00a0 You'd mitigate as best you could with careful access control (right?) and handle incidents as they occurred.\u00a0 Beyond that, what?\u00a0 Fire all your foreign visa holders?\u003Cbr /\u003E\u003Cbr /\u003ETimes have changed.\u00a0 Global enterprises are investing in China, India, Russia, and elsewhere, creating new opportunities for an entire generation of workers to succeed without having to emigrate from their own cultures and communities.\u003Cbr /\u003E\u003Cbr /\u003EAnd that's how I, Eric the Prophet, can predict \u003Ca href=\"http://www.thebigmoney.com/blogs/feeling-lucky/2010/01/18/googlechina-clinton-address-crisis-thursday\"\u003Eroughly what Hillary Clinton is going to say to China\u003C/a\u003E on Thursday:\u003Cbr /\u003E\u003Cbr /\u003E\u003Cem\u003EAll of this investment is supposed to give you guys some skin in the game.\u00a0 Surely you don't prefer the previous arrangement, in which the \"developed\" world lures China's best and brightest abroad, and \u003C/em\u003E\u003Cem\u003EChina's role in the global economy is relegated to \"factory?\"\u003C/em\u003E\u003Cbr /\u003E\u003Cbr /\u003EIs anybody else just a little bit curious as to the global economy's capacity to issue pink slips in countries whose governments can't or won't prevent the emission of cyberattacks?\u003Cbr /\u003E\u003Cbr /\u003Ep.s.\u00a0 On a personal note, I helped Microsoft select candidates for IT Security positions in China back in 2004.\u00a0 As I recall, wages for Chinese IT staff were on the order of US $5.00/hr.\u00a0 Whatever resentment I felt towards Microsoft at the time for not cutting me in on the expected savings has given way to something more like schadenfreude."} <p><a href="http://mashable.com/2010/01/18/attack-google-inside-job/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+Mashable+%28Mashable%29">People are catching on</a> to what the <a href="http://lists.immunitysec.com/pipermail/dailydave/2010-January/005995.html">smart kids knew</a> all along: <em>of course</em> Google's Chinese offices were compromised.  And not just Google, and not just in China, and not just by China.<br /><br />Ten years ago, the disloyal insider was a fact of life about which there wasn't much to be done.  You'd mitigate as best you could with careful access control (right?) and handle incidents as they occurred.  Beyond that, what?  Fire all your foreign visa holders?<br /><br />Times have changed.  Global enterprises are investing in China, India, Russia, and elsewhere, creating new opportunities for an entire generation of workers to succeed without having to emigrate from their own cultures and communities.<br /><br />And that's how I, Eric the Prophet, can predict <a href="http://www.thebigmoney.com/blogs/feeling-lucky/2010/01/18/googlechina-clinton-address-crisis-thursday">roughly what Hillary Clinton is going to say to China</a> on Thursday:<br /><br /><em>All of this investment is supposed to give you guys some skin in the game.  Surely you don't prefer the previous arrangement, in which the "developed" world lures China's best and brightest abroad, and </em><em>China's role in the global economy is relegated to "factory?"</em><br /><br />Is anybody else just a little bit curious as to the global economy's capacity to issue pink slips in countries whose governments can't or won't prevent the emission of cyberattacks?<br /><br />p.s.  On a personal note, I helped Microsoft select candidates for IT Security positions in China back in 2004.  As I recall, wages for Chinese IT staff were on the order of US $5.00/hr.  Whatever resentment I felt towards Microsoft at the time for not cutting me in on the expected savings has given way to something more like schadenfreude.</p> <p><a href="http://mashable.com/2010/01/18/attack-google-inside-job/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+Mashable+%28Mashable%29">http://mashable.com/2010/01/18/attack-google-inside-job/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29</a></p>Tue, 19 Jan 2010 03:44:24 GMThttp://soup.rachner.us/post/42213514/Offshoring-Partners-amp-The-Hand-That-Feedsurn:www-soup-io:1:42213514linkchinaauroragooglemicrosoftoffshoringdoingitwrong {"tags":["blackberry","doingitwrong"],"type":"regular","title":"Duly Noted","source":null,"body":"From the Blackberry Enterprise Server administration manual:\u003Cbr /\u003E\u003Cbr /\u003E\u003Cem\u003E\"To ensure [system] email is not blocked or modified, the blackberry.net\ndomain should be whitelisted against any anti-virus, anti-spam, or\nblacklisting software utilized by the email system or gateway.\"\u003C/em\u003E\u003Cbr /\u003E\u003Cbr /\u003ETranslation:\u003Cbr /\u003E\u003Cbr /\u003E\u003Cem\u003E\"Hackers interested in bypassing any anti-virus, anti-spam and blacklisting software utilized by Blackberry customers are hereby advised to use forged source addresses ending in blackberry.net.\"\u003C/em\u003E\u003Cbr /\u003E"} From the Blackberry Enterprise Server administration manual:<br /><br /><em>"To ensure [system] email is not blocked or modified, the blackberry.net domain should be whitelisted against any anti-virus, anti-spam, or blacklisting software utilized by the email system or gateway."</em><br /><br />Translation:<br /><br /><em>"Hackers interested in bypassing any anti-virus, anti-spam and blacklisting software utilized by Blackberry customers are hereby advised to use forged source addresses ending in blackberry.net."</em><br />Wed, 13 Jan 2010 15:15:16 GMThttp://soup.rachner.us/post/41477439/Duly-Notedurn:www-soup-io:1:41477439regularblackberrydoingitwrong {"tags":["threat modeling","doingitwrong"],"type":"regular","title":"A Grain of Salt for Digital Asset Values","source":null,"body":"\u003C!--[if gte mso 9]\u003E\u003Cxml\u003E\n \u003Cw:worddocument\u003E\n \u003Cw:view\u003ENormal\u003C/w:view\u003E\n \u003Cw:zoom\u003E0\u003C/w:zoom\u003E\n \u003Cw:trackmoves/\u003E\n \u003Cw:trackformatting/\u003E\n \u003Cw:punctuationkerning/\u003E\n \u003Cw:validateagainstschemas/\u003E\n \u003Cw:saveifxmlinvalid\u003Efalse\u003C/w:saveifxmlinvalid\u003E\n \u003Cw:ignoremixedcontent\u003Efalse\u003C/w:ignoremixedcontent\u003E\n \u003Cw:alwaysshowplaceholdertext\u003Efalse\u003C/w:alwaysshowplaceholdertext\u003E\n \u003Cw:donotpromoteqf/\u003E\n \u003Cw:lidthemeother\u003EEN-US\u003C/w:lidthemeother\u003E\n \u003Cw:lidthemeasian\u003EX-NONE\u003C/w:lidthemeasian\u003E\n \u003Cw:lidthemecomplexscript\u003EX-NONE\u003C/w:lidthemecomplexscript\u003E\n \u003Cw:compatibility\u003E\n \u003Cw:breakwrappedtables/\u003E\n \u003Cw:snaptogridincell/\u003E\n \u003Cw:wraptextwithpunct/\u003E\n \u003Cw:useasianbreakrules/\u003E\n \u003Cw:dontgrowautofit/\u003E\n \u003Cw:splitpgbreakandparamark/\u003E\n \u003Cw:dontvertaligncellwithsp/\u003E\n \u003Cw:dontbreakconstrainedforcedtables/\u003E\n \u003Cw:dontvertalignintxbx/\u003E\n \u003Cw:word11kerningpairs/\u003E\n \u003Cw:cachedcolbalance/\u003E\n \u003C/w:compatibility\u003E\n \u003Cm:mathpr\u003E\n \u003Cm:mathfont m:val=\"Cambria Math\"/\u003E\n \u003Cm:brkbin m:val=\"before\"/\u003E\n \u003Cm:brkbinsub m:val=\"\u0026#45;-\"/\u003E\n \u003Cm:smallfrac m:val=\"off\"/\u003E\n \u003Cm:dispdef/\u003E\n \u003Cm:lmargin m:val=\"0\"/\u003E\n \u003Cm:rmargin m:val=\"0\"/\u003E\n \u003Cm:defjc m:val=\"centerGroup\"/\u003E\n \u003Cm:wrapindent m:val=\"1440\"/\u003E\n \u003Cm:intlim m:val=\"subSup\"/\u003E\n \u003Cm:narylim m:val=\"undOvr\"/\u003E\n \u003C/m:mathpr\u003E\u003C/w:worddocument\u003E\n\u003C/xml\u003E\u003C![endif]--\u003E\u003C!--[if gte mso 9]\u003E\u003Cxml\u003E\n \u003Cw:latentstyles deflockedstate=\"false\" defunhidewhenused=\"true\"\n defsemihidden=\"true\" defqformat=\"false\" defpriority=\"99\"\n latentstylecount=\"267\"\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"0\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Normal\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"heading 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 7\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 8\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"9\" qformat=\"true\" name=\"heading 9\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 7\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 8\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" name=\"toc 9\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"35\" qformat=\"true\" name=\"caption\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"10\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Title\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"1\" name=\"Default Paragraph Font\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"11\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Subtitle\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"22\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Strong\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"20\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Emphasis\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"59\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Table Grid\"/\u003E\n \u003Cw:lsdexception locked=\"false\" unhidewhenused=\"false\" name=\"Placeholder Text\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"1\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"No Spacing\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" unhidewhenused=\"false\" name=\"Revision\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"34\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"List Paragraph\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"29\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Quote\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"30\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Intense Quote\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 1\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 2\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 3\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 4\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 5\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"60\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Shading Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"61\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light List Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"62\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Light Grid Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"63\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 1 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"64\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Shading 2 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"65\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 1 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"66\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium List 2 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"67\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 1 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"68\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 2 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"69\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Medium Grid 3 Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"70\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Dark List Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"71\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Shading Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"72\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful List Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"73\" semihidden=\"false\"\n unhidewhenused=\"false\" name=\"Colorful Grid Accent 6\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"19\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Subtle Emphasis\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"21\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Intense Emphasis\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"31\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Subtle Reference\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"32\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Intense Reference\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"33\" semihidden=\"false\"\n unhidewhenused=\"false\" qformat=\"true\" name=\"Book Title\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"37\" name=\"Bibliography\"/\u003E\n \u003Cw:lsdexception locked=\"false\" priority=\"39\" qformat=\"true\" name=\"TOC Heading\"/\u003E\n \u003C/w:latentstyles\u003E\n\u003C/xml\u003E\u003C![endif]--\u003E\n\u0026amp;amp;amp;amp;amp;amp;amp;lt;!--\n /* Font Definitions */\n @font-face\n\t{font-family:Wingdings;\n\tpanose-1:5 0 0 0 0 0 0 0 0 0;\n\tmso-font-charset:2;\n\tmso-generic-font-family:auto;\n\tmso-font-pitch:variable;\n\tmso-font-signature:0 268435456 0 0 -2147483648 0;}\n@font-face\n\t{font-family:\"Cambria Math\";\n\tpanose-1:2 4 5 3 5 4 6 3 2 4;\n\tmso-font-charset:1;\n\tmso-generic-font-family:roman;\n\tmso-font-format:other;\n\tmso-font-pitch:variable;\n\tmso-font-signature:0 0 0 0 0 0;}\n@font-face\n\t{font-family:Calibri;\n\tpanose-1:2 15 5 2 2 2 4 3 2 4;\n\tmso-font-charset:0;\n\tmso-generic-font-family:swiss;\n\tmso-font-pitch:variable;\n\tmso-font-signature:-1610611985 1073750139 0 0 159 0;}\n /* Style Definitions */\n p.MsoNormal, li.MsoNormal, div.MsoNormal\n\t{mso-style-unhide:no;\n\tmso-style-qformat:yes;\n\tmso-style-parent:\"\";\n\tmargin-top:0in;\n\tmargin-right:0in;\n\tmargin-bottom:10.0pt;\n\tmargin-left:0in;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\na:link, span.MsoHyperlink\n\t{mso-style-priority:99;\n\tcolor:blue;\n\ttext-decoration:underline;\n\ttext-underline:single;}\na:visited, span.MsoHyperlinkFollowed\n\t{mso-style-noshow:yes;\n\tmso-style-priority:99;\n\tcolor:purple;\n\tmso-themecolor:followedhyperlink;\n\ttext-decoration:underline;\n\ttext-underline:single;}\np.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph\n\t{mso-style-priority:34;\n\tmso-style-unhide:no;\n\tmso-style-qformat:yes;\n\tmargin-top:0in;\n\tmargin-right:0in;\n\tmargin-bottom:10.0pt;\n\tmargin-left:.5in;\n\tmso-add-space:auto;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\np.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst\n\t{mso-style-priority:34;\n\tmso-style-unhide:no;\n\tmso-style-qformat:yes;\n\tmso-style-type:export-only;\n\tmargin-top:0in;\n\tmargin-right:0in;\n\tmargin-bottom:0in;\n\tmargin-left:.5in;\n\tmargin-bottom:.0001pt;\n\tmso-add-space:auto;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\np.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle\n\t{mso-style-priority:34;\n\tmso-style-unhide:no;\n\tmso-style-qformat:yes;\n\tmso-style-type:export-only;\n\tmargin-top:0in;\n\tmargin-right:0in;\n\tmargin-bottom:0in;\n\tmargin-left:.5in;\n\tmargin-bottom:.0001pt;\n\tmso-add-space:auto;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\np.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast\n\t{mso-style-priority:34;\n\tmso-style-unhide:no;\n\tmso-style-qformat:yes;\n\tmso-style-type:export-only;\n\tmargin-top:0in;\n\tmargin-right:0in;\n\tmargin-bottom:10.0pt;\n\tmargin-left:.5in;\n\tmso-add-space:auto;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\n.MsoChpDefault\n\t{mso-style-type:export-only;\n\tmso-default-props:yes;\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-fareast-font-family:Calibri;\n\tmso-fareast-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;\n\tmso-bidi-font-family:\"Times New Roman\";\n\tmso-bidi-theme-font:minor-bidi;}\n.MsoPapDefault\n\t{mso-style-type:export-only;\n\tmargin-bottom:10.0pt;\n\tline-height:115%;}\n@\u0026amp;amp;amp;amp;amp;amp;lt;a href=\"http://page.soup.io\"\u0026amp;amp;amp;amp;amp;amp;gt;page\u0026amp;amp;amp;amp;amp;amp;lt;/a\u0026amp;amp;amp;amp;amp;amp;gt; Section1\n\t{size:8.5in 11.0in;\n\tmargin:1.0in 1.0in 1.0in 1.0in;\n\tmso-header-margin:.5in;\n\tmso-footer-margin:.5in;\n\tmso-paper-source:0;}\ndiv.Section1\n\t{page:Section1;}\n /* List Definitions */\n @list l0\n\t{mso-list-id:1023358003;\n\tmso-list-type:hybrid;\n\tmso-list-template-ids:-1676016582 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}\n@list l0:level1\n\t{mso-level-number-format:bullet;\n\tmso-level-text:\uf0b7;\n\tmso-level-tab-stop:none;\n\tmso-level-number-position:left;\n\ttext-indent:-.25in;\n\tfont-family:Symbol;}\nol\n\t{margin-bottom:0in;}\nul\n\t{margin-bottom:0in;}\n--\u0026amp;amp;amp;amp;amp;amp;amp;gt;\n\u003C!--[if gte mso 10]\u003E\n\u003Cstyle\u003E\n /* Style Definitions */\n table.MsoNormalTable\n\t{mso-style-name:\"Table Normal\";\n\tmso-tstyle-rowband-size:0;\n\tmso-tstyle-colband-size:0;\n\tmso-style-noshow:yes;\n\tmso-style-priority:99;\n\tmso-style-qformat:yes;\n\tmso-style-parent:\"\";\n\tmso-padding-alt:0in 5.4pt 0in 5.4pt;\n\tmso-para-margin-top:0in;\n\tmso-para-margin-right:0in;\n\tmso-para-margin-bottom:10.0pt;\n\tmso-para-margin-left:0in;\n\tline-height:115%;\n\tmso-pagination:widow-orphan;\n\tfont-size:11.0pt;\n\tfont-family:\"Calibri\",\"sans-serif\";\n\tmso-ascii-font-family:Calibri;\n\tmso-ascii-theme-font:minor-latin;\n\tmso-hansi-font-family:Calibri;\n\tmso-hansi-theme-font:minor-latin;}\n\u003C/style\u003E\n\u003C![endif]--\u003E\n\n\u003Cp\u003EA \u003Ca href=\"http://newschoolsecurity.com/2009/10/how-to-value-digital-assets-web-sites-etc/\"\u003Erecent\u003C/a\u003E\n\u003Ca href=\"http://blogs.forrester.com/srm/2009/10/information-asset-value-some-coldhearted-calculations-.html\"\u003Eflurry\u003C/a\u003E\nof \u003Ca href=\"http://communities.intel.com/community/openportit/it/blog/2009/10/22/how-to-value-digital-assets\"\u003Eblog\u003C/a\u003E\n\u003Ca href=\"http://newschoolsecurity.com/2009/10/on-the-value-of-digital-asset-value-for-security-decisions/\"\u003Eposts\u003C/a\u003E\nby some very smart people has reminded me of how in my former life at Microsoft,\nI often found myself in meetings whose agenda included tallying up the\nso-called \"digital assets\" related to a given project.\u003Cbr /\u003E\n\u003Cbr /\u003E\nFor the uninitiated, the \"digital asset\" is the starting point in\npretty much every formal and semi-formal IT risk analysis exercise, to\nwit:\u00a0 What are we protecting, after all, if not assets? What uniquely\ndigital threats imperil these assets, and how awful would it be if any of those\nthreats should be realized, and what are the potential mitigations for each\nthreat, and what is the cost of each contemplated mitigation, and can I somehow\navoid being summoned to any more of these meetings, or do I need to step up my\nsearch for a new position in the company?\u003C/p\u003E\n\n\u003Cp\u003EGranted, as a starting point for getting a handle on your\nsecurity spend, it seems only reasonable to boil everything down to a finite\nlist of items. \u00a0The obvious next step is,\nlet\u2019s appraise the items in our list according to some kind of valuation scheme,\nand start sorting.\u00a0 There\u2019s \u003Ca href=\"http://www.cert.org/octave/\"\u003Eplenty\u003C/a\u003E of \u003Ca href=\"http://www.octotrike.org/\"\u003Emethodologies\u003C/a\u003E to \u003Ca href=\"http://msdn.microsoft.com/en-us/security/aa570413.aspx\"\u003Epick\u003C/a\u003E \u003Ca href=\"http://newschoolsecurity.com/2009/10/how-to-value-digital-assets-web-sites-etc/\"\u003Efrom\u003C/a\u003E.\u003C/p\u003E\n\n\u003Cp\u003EExcept that we\u2019re not \u003Ca href=\"http://www.theonion.com/content/news/tina_turner_burns_down_legs_for\"\u003Einsuring\nTina Turner\u2019s legs\u003C/a\u003E here.\u00a0 I contend that there is \u003Ci\u003Eno useful relationship \u003C/i\u003Ebetween\nasset value and loss-per-incident.\u003C/p\u003E\n\n\u003Cp\u003EWith that claim in mind, let\u2019s review the types of costs\nassociated with typical real-world hacking incidents, and ask ourselves which\nof these costs will vary according to some pre-estimated value of the compromised\ndigital assets:\u003C/p\u003E\u003Cp\u003E* Engagement of incident response specialists\u003Cbr /\u003E* Damage to reputation / loss of future business\u003Cbr /\u003E* Loss of business advantage (e.g., leakage of details concerning payroll, pending deals, R\u0026amp;D, etc.)\u003Cbr /\u003E* Direct financial loss (e.g., fraudulent transactions)\u003Cbr /\u003E* Disruption of regular business operations\u003Cbr /\u003E* Fines and penalties\u003C/p\u003E\u003Cp\u003E\u003C!--[if !supportLists]--\u003EActually, I wrote that list in order, ranging from \u201cno\nrelationship to asset values\u201d to \u201cperhaps some vague, tenuous relationship.\u201d\u003C/p\u003E\n\n\u003Cp\u003ESure, the cost of an hour\u2019s operational disruption might be\nestimable in advance, especially when service level agreements are in place.\u00a0 But when we attempt to quantify the cost of\ndowntime, are we even talking about \u003Ci\u003Eassets\u003C/i\u003E\nany more?\u003C/p\u003E\n\nAnd is it possible that when we fetishize over\nthe valuations of individual data assets, we\u2019re taking our eyes off the\nloss-avoidance ball?"} &lt;!--[if gte mso 9]>&lt;xml> &lt;w:worddocument> &lt;w:view>Normal&lt;/w:view> &lt;w:zoom>0&lt;/w:zoom> &lt;w:trackmoves/> &lt;w:trackformatting/> &lt;w:punctuationkerning/> &lt;w:validateagainstschemas/> &lt;w:saveifxmlinvalid>false&lt;/w:saveifxmlinvalid> &lt;w:ignoremixedcontent>false&lt;/w:ignoremixedcontent> &lt;w:alwaysshowplaceholdertext>false&lt;/w:alwaysshowplaceholdertext> &lt;w:donotpromoteqf/> &lt;w:lidthemeother>EN-US&lt;/w:lidthemeother> &lt;w:lidthemeasian>X-NONE&lt;/w:lidthemeasian> &lt;w:lidthemecomplexscript>X-NONE&lt;/w:lidthemecomplexscript> &lt;w:compatibility> &lt;w:breakwrappedtables/> &lt;w:snaptogridincell/> &lt;w:wraptextwithpunct/> &lt;w:useasianbreakrules/> &lt;w:dontgrowautofit/> &lt;w:splitpgbreakandparamark/> &lt;w:dontvertaligncellwithsp/> &lt;w:dontbreakconstrainedforcedtables/> &lt;w:dontvertalignintxbx/> &lt;w:word11kerningpairs/> &lt;w:cachedcolbalance/> &lt;/w:compatibility> &lt;m:mathpr> &lt;m:mathfont m:val="Cambria Math"/> &lt;m:brkbin m:val="before"/> &lt;m:brkbinsub m:val="&#45;-"/> &lt;m:smallfrac m:val="off"/> &lt;m:dispdef/> &lt;m:lmargin m:val="0"/> &lt;m:rmargin m:val="0"/> &lt;m:defjc m:val="centerGroup"/> &lt;m:wrapindent m:val="1440"/> &lt;m:intlim m:val="subSup"/> &lt;m:narylim m:val="undOvr"/> &lt;/m:mathpr>&lt;/w:worddocument> &lt;/xml>&lt;![endif]-->&lt;!--[if gte mso 9]>&lt;xml> &lt;w:latentstyles deflockedstate="false" defunhidewhenused="true" defsemihidden="true" defqformat="false" defpriority="99" latentstylecount="267"> &lt;w:lsdexception locked="false" priority="0" semihidden="false" unhidewhenused="false" qformat="true" name="Normal"/> &lt;w:lsdexception locked="false" priority="9" semihidden="false" unhidewhenused="false" qformat="true" name="heading 1"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 2"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 3"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 4"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 5"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 6"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 7"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 8"/> &lt;w:lsdexception locked="false" priority="9" qformat="true" name="heading 9"/> &lt;w:lsdexception locked="false" priority="39" name="toc 1"/> &lt;w:lsdexception locked="false" priority="39" name="toc 2"/> &lt;w:lsdexception locked="false" priority="39" name="toc 3"/> &lt;w:lsdexception locked="false" priority="39" name="toc 4"/> &lt;w:lsdexception locked="false" priority="39" name="toc 5"/> &lt;w:lsdexception locked="false" priority="39" name="toc 6"/> &lt;w:lsdexception locked="false" priority="39" name="toc 7"/> &lt;w:lsdexception locked="false" priority="39" name="toc 8"/> &lt;w:lsdexception locked="false" priority="39" name="toc 9"/> &lt;w:lsdexception locked="false" priority="35" qformat="true" name="caption"/> &lt;w:lsdexception locked="false" priority="10" semihidden="false" unhidewhenused="false" qformat="true" name="Title"/> &lt;w:lsdexception locked="false" priority="1" name="Default Paragraph Font"/> &lt;w:lsdexception locked="false" priority="11" semihidden="false" unhidewhenused="false" qformat="true" name="Subtitle"/> &lt;w:lsdexception locked="false" priority="22" semihidden="false" unhidewhenused="false" qformat="true" name="Strong"/> &lt;w:lsdexception locked="false" priority="20" semihidden="false" unhidewhenused="false" qformat="true" name="Emphasis"/> &lt;w:lsdexception locked="false" priority="59" semihidden="false" unhidewhenused="false" name="Table Grid"/> &lt;w:lsdexception locked="false" unhidewhenused="false" name="Placeholder Text"/> &lt;w:lsdexception locked="false" priority="1" semihidden="false" unhidewhenused="false" qformat="true" name="No Spacing"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 1"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 1"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 1"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 1"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 1"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 1"/> &lt;w:lsdexception locked="false" unhidewhenused="false" name="Revision"/> &lt;w:lsdexception locked="false" priority="34" semihidden="false" unhidewhenused="false" qformat="true" name="List Paragraph"/> &lt;w:lsdexception locked="false" priority="29" semihidden="false" unhidewhenused="false" qformat="true" name="Quote"/> &lt;w:lsdexception locked="false" priority="30" semihidden="false" unhidewhenused="false" qformat="true" name="Intense Quote"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 1"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 1"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 1"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 1"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 1"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 1"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 1"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 1"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 2"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 2"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 2"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 2"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 2"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 2"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 2"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 2"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 2"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 2"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 2"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 2"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 2"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 2"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 3"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 3"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 3"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 3"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 3"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 3"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 3"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 3"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 3"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 3"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 3"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 3"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 3"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 3"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 4"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 4"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 4"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 4"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 4"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 4"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 4"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 4"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 4"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 4"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 4"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 4"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 4"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 4"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 5"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 5"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 5"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 5"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 5"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 5"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 5"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 5"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 5"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 5"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 5"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 5"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 5"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 5"/> &lt;w:lsdexception locked="false" priority="60" semihidden="false" unhidewhenused="false" name="Light Shading Accent 6"/> &lt;w:lsdexception locked="false" priority="61" semihidden="false" unhidewhenused="false" name="Light List Accent 6"/> &lt;w:lsdexception locked="false" priority="62" semihidden="false" unhidewhenused="false" name="Light Grid Accent 6"/> &lt;w:lsdexception locked="false" priority="63" semihidden="false" unhidewhenused="false" name="Medium Shading 1 Accent 6"/> &lt;w:lsdexception locked="false" priority="64" semihidden="false" unhidewhenused="false" name="Medium Shading 2 Accent 6"/> &lt;w:lsdexception locked="false" priority="65" semihidden="false" unhidewhenused="false" name="Medium List 1 Accent 6"/> &lt;w:lsdexception locked="false" priority="66" semihidden="false" unhidewhenused="false" name="Medium List 2 Accent 6"/> &lt;w:lsdexception locked="false" priority="67" semihidden="false" unhidewhenused="false" name="Medium Grid 1 Accent 6"/> &lt;w:lsdexception locked="false" priority="68" semihidden="false" unhidewhenused="false" name="Medium Grid 2 Accent 6"/> &lt;w:lsdexception locked="false" priority="69" semihidden="false" unhidewhenused="false" name="Medium Grid 3 Accent 6"/> &lt;w:lsdexception locked="false" priority="70" semihidden="false" unhidewhenused="false" name="Dark List Accent 6"/> &lt;w:lsdexception locked="false" priority="71" semihidden="false" unhidewhenused="false" name="Colorful Shading Accent 6"/> &lt;w:lsdexception locked="false" priority="72" semihidden="false" unhidewhenused="false" name="Colorful List Accent 6"/> &lt;w:lsdexception locked="false" priority="73" semihidden="false" unhidewhenused="false" name="Colorful Grid Accent 6"/> &lt;w:lsdexception locked="false" priority="19" semihidden="false" unhidewhenused="false" qformat="true" name="Subtle Emphasis"/> &lt;w:lsdexception locked="false" priority="21" semihidden="false" unhidewhenused="false" qformat="true" name="Intense Emphasis"/> &lt;w:lsdexception locked="false" priority="31" semihidden="false" unhidewhenused="false" qformat="true" name="Subtle Reference"/> &lt;w:lsdexception locked="false" priority="32" semihidden="false" unhidewhenused="false" qformat="true" name="Intense Reference"/> &lt;w:lsdexception locked="false" priority="33" semihidden="false" unhidewhenused="false" qformat="true" name="Book Title"/> &lt;w:lsdexception locked="false" priority="37" name="Bibliography"/> &lt;w:lsdexception locked="false" priority="39" qformat="true" name="TOC Heading"/> &lt;/w:latentstyles> &lt;/xml>&lt;![endif]--> &amp;amp;amp;amp;amp;amp;amp;lt;!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0; mso-font-charset:2; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:0 268435456 0 0 -2147483648 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4; mso-font-charset:1; mso-generic-font-family:roman; mso-font-format:other; mso-font-pitch:variable; mso-font-signature:0 0 0 0 0 0;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4; mso-font-charset:0; mso-generic-font-family:swiss; mso-font-pitch:variable; mso-font-signature:-1610611985 1073750139 0 0 159 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-unhide:no; mso-style-qformat:yes; mso-style-parent:""; margin-top:0in; margin-right:0in; margin-bottom:10.0pt; margin-left:0in; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline; text-underline:single;} a:visited, span.MsoHyperlinkFollowed {mso-style-noshow:yes; mso-style-priority:99; color:purple; mso-themecolor:followedhyperlink; text-decoration:underline; text-underline:single;} p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {mso-style-priority:34; mso-style-unhide:no; mso-style-qformat:yes; margin-top:0in; margin-right:0in; margin-bottom:10.0pt; margin-left:.5in; mso-add-space:auto; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst {mso-style-priority:34; mso-style-unhide:no; mso-style-qformat:yes; mso-style-type:export-only; margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; mso-add-space:auto; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle {mso-style-priority:34; mso-style-unhide:no; mso-style-qformat:yes; mso-style-type:export-only; margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; mso-add-space:auto; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {mso-style-priority:34; mso-style-unhide:no; mso-style-qformat:yes; mso-style-type:export-only; margin-top:0in; margin-right:0in; margin-bottom:10.0pt; margin-left:.5in; mso-add-space:auto; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} .MsoChpDefault {mso-style-type:export-only; mso-default-props:yes; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;} .MsoPapDefault {mso-style-type:export-only; margin-bottom:10.0pt; line-height:115%;} @&amp;amp;amp;amp;amp;amp;lt;a href="<a href="http://page.soup.io&quot;&amp;amp;amp;amp;amp;amp;gt;page&amp;amp;amp;amp;amp;amp;lt;/a&amp;amp;amp;amp;amp;amp;gt">http://page.soup.io&quot;&amp;amp;amp;amp;amp;amp;amp;gt;page&amp;amp;amp;amp;amp;amp;amp;lt;/a&amp;amp;amp;amp;amp;amp;amp;gt</a>; Section1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in; mso-header-margin:.5in; mso-footer-margin:.5in; mso-paper-source:0;} div.Section1 {page:Section1;} /* List Definitions */ @list l0 {mso-list-id:1023358003; mso-list-type:hybrid; mso-list-template-ids:-1676016582 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;} @list l0:level1 {mso-level-number-format:bullet; mso-level-text:; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-.25in; font-family:Symbol;} ol {margin-bottom:0in;} ul {margin-bottom:0in;} --&amp;amp;amp;amp;amp;amp;amp;gt; &lt;!--[if gte mso 10]> &lt;style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin-top:0in; mso-para-margin-right:0in; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0in; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} &lt;/style> &lt;![endif]--> <p>A <a href="http://newschoolsecurity.com/2009/10/how-to-value-digital-assets-web-sites-etc/">recent</a> <a href="http://blogs.forrester.com/srm/2009/10/information-asset-value-some-coldhearted-calculations-.html">flurry</a> of <a href="http://communities.intel.com/community/openportit/it/blog/2009/10/22/how-to-value-digital-assets">blog</a> <a href="http://newschoolsecurity.com/2009/10/on-the-value-of-digital-asset-value-for-security-decisions/">posts</a> by some very smart people has reminded me of how in my former life at Microsoft, I often found myself in meetings whose agenda included tallying up the so-called "digital assets" related to a given project.<br /> <br /> For the uninitiated, the "digital asset" is the starting point in pretty much every formal and semi-formal IT risk analysis exercise, to wit:  What are we protecting, after all, if not assets? What uniquely digital threats imperil these assets, and how awful would it be if any of those threats should be realized, and what are the potential mitigations for each threat, and what is the cost of each contemplated mitigation, and can I somehow avoid being summoned to any more of these meetings, or do I need to step up my search for a new position in the company?</p> <p>Granted, as a starting point for getting a handle on your security spend, it seems only reasonable to boil everything down to a finite list of items.  The obvious next step is, let’s appraise the items in our list according to some kind of valuation scheme, and start sorting.  There’s <a href="http://www.cert.org/octave/">plenty</a> of <a href="http://www.octotrike.org/">methodologies</a> to <a href="http://msdn.microsoft.com/en-us/security/aa570413.aspx">pick</a> <a href="http://newschoolsecurity.com/2009/10/how-to-value-digital-assets-web-sites-etc/">from</a>.</p> <p>Except that we’re not <a href="http://www.theonion.com/content/news/tina_turner_burns_down_legs_for">insuring Tina Turner’s legs</a> here.  I contend that there is <i>no useful relationship </i>between asset value and loss-per-incident.</p> <p>With that claim in mind, let’s review the types of costs associated with typical real-world hacking incidents, and ask ourselves which of these costs will vary according to some pre-estimated value of the compromised digital assets:</p><p>* Engagement of incident response specialists<br />* Damage to reputation / loss of future business<br />* Loss of business advantage (e.g., leakage of details concerning payroll, pending deals, R&amp;D, etc.)<br />* Direct financial loss (e.g., fraudulent transactions)<br />* Disruption of regular business operations<br />* Fines and penalties</p><p>&lt;!--[if !supportLists]-->Actually, I wrote that list in order, ranging from “no relationship to asset values” to “perhaps some vague, tenuous relationship.”</p> <p>Sure, the cost of an hour’s operational disruption might be estimable in advance, especially when service level agreements are in place.  But when we attempt to quantify the cost of downtime, are we even talking about <i>assets</i> any more?</p> And is it possible that when we fetishize over the valuations of individual data assets, we’re taking our eyes off the loss-avoidance ball?Mon, 26 Oct 2009 06:53:09 GMThttp://soup.rachner.us/post/32537875/A-Grain-of-Salt-for-Digital-Asseturn:www-soup-io:1:32537875regularthreat modelingdoingitwrong {"tags":[],"type":"regular","title":"Rebooting.","source":null,"body":"It's been quite a while since my old blog was a casualty of the \u003Ca href=\"http://simonwillison.net/2007/Jun/6/dreamhost/\"\u003EDreamhost hacking incident\u003C/a\u003E, and I've been more than a little remiss about restoring things.\u003Cbr /\u003E\u003Cbr /\u003EBut Soup.io seems to be a pretty cool way to publish, so I'm giving it a whirl.\u003Cbr /\u003E\u003Cbr /\u003EThose of you looking for Alcatraz, GPCul8r, or Scurvy will find them published again on this page in the very near future.\u003Cbr /\u003E\u003Cbr /\u003ECheers,\u003Cbr /\u003E\u003Cbr /\u003E- Eric\u003Cbr /\u003E"} It's been quite a while since my old blog was a casualty of the <a href="http://simonwillison.net/2007/Jun/6/dreamhost/">Dreamhost hacking incident</a>, and I've been more than a little remiss about restoring things.<br /><br />But Soup.io seems to be a pretty cool way to publish, so I'm giving it a whirl.<br /><br />Those of you looking for Alcatraz, GPCul8r, or Scurvy will find them published again on this page in the very near future.<br /><br />Cheers,<br /><br />- Eric<br />Tue, 31 Mar 2009 09:21:35 GMThttp://soup.rachner.us/post/16474727/Rebootingurn:www-soup-io:1:16474727regular