Often when you ask someone what is important on their network, they will say Everything. But that cannot be the case. You have to determine your High Value Targets first. A High Value Target is a device, system, database or resource that you cannot live without and still accomplish your mission. If you look at this from a military perspective, it is the key targets that can win you or lose you the war. This may seem like common sense, but strangely many people have not considered this. We protect networks so they can accomplish some defined mission whether it be information sharing or business related as examples. Too often its seems we forget the mission part and don whether designing an infrastructure or monitoring that infrastructure. It becomes just a checklist….IDS (check)…Firewall(check)…Antivirus(check)…logs(check)…but are you really focusing on what is critical?
To protect a network/resource properly, we have to know your High Value Targets. In order to do this, we to talk with your different business areas that make up your company/organization and understand what is important to them and what risk are they willing to take. It may be that we have to help guide them to even get them to understand what we are asking. That is ok, If you dont understand what is important to the company/organization, then our ability to design or monitor an infrastructure effectively is greatly diminished. If you asked all your employees what the top five High Value Targets were on your network, what answers would you get? Would those answers line up with the business owners? An attack or anomalous traffic toward one asset may not be that worrying, but what if its toward one of your High Value Targets?
In todays world, the threat has become very tailored and very specific. We have so much traffic to monitor on our infrastructures today that we have to have a tailored and structured approach to monitoring. You have to know what has the priority when it comes to protecting and/or monitoring. What cant the company/organization live without? I can assure you that the attacker is trying to find or already knows your high value targets. The real question is do you know what they are?