Crown jewels and business impact
A crown jewel is a system, application, identity, data set or business process whose compromise would matter to the business, designated by you with the criticality you assign it. The CyberOptix CTEM Platform then says, per jewel, how the attack paths reach it, how far validation has proven that reach, what the model makes of the chance it is compromised, and, where you have given numbers, what that would cost.
The division of labour is deliberate. You state what matters and what it would cost; the platform works out how an attacker gets there. Neither side invents the other's input.
Designating a jewel
A jewel has a kind (asset, application, identity, data or process), the thing it points at (an asset in the registry, or a set of members), a name, an owner, an optional business unit, and a business criticality of your choosing. Designations are reviewed and reaffirmed; a jewel that no longer matters is retired rather than deleted, so its history stays readable.
Designation happens on the Risk Posture page, under Exposure Management: its Crown jewels tab lists every designation, Designate opens the form, Edit restates one, Retire ends it after you confirm, and State impact records a consequence category. An application is found by name, an asset by its type and name, an identity by its directory and id; a data set or a process is declared from its members. Each is a queued write, and the figures follow on the next refresh.
Criticality is grouped, never weighed. In the figures the jewels are counted by criticality, and a critical jewel is listed before a lower one, but no figure is multiplied by it. The platform keeps its own reading of how a jewel is reached as technical importance (how many entries reach it, whether any reach is demonstrated, and the likeliest of them) beside your criticality, and the two are never merged.
SCREENSHOT: the Crown jewels card on the Risk Posture page, with criticality and the snapshot's reach side by side.
Stating the consequences
For each jewel you record one or more impacts, each in a category: financial loss, operational disruption, data exposure, regulatory, or reputational. Every impact carries a rating (negligible to severe) and a narrative. An impact may also be quantified, in one of these shapes:
| Shape | What you give |
|---|---|
| Three-point estimate | A low, a most likely and a high loss, which the model combines into one figure weighted toward the most likely value |
| Single scenario loss | One loss figure for the whole scenario |
| Components | Hours of downtime with a loss per hour, response and recovery cost, and other costs, added |
Each quantified impact records its basis: a number you provided, an assumption you made, or a model assumption where you gave none for a parameter. You may also state, per impact, how likely a severe outcome is given that an attacker reaches the jewel; where you do not, the model's named assumption applies and the figure says so.
All of a jewel's numbers must be in one currency. Nothing is converted.
How reach is priced
A jewel is reached when a step on some attack path lands on one of its members. Each reach is placed on a rung:
| Rung | Meaning |
|---|---|
| Demonstrated | The step that lands on the jewel was demonstrated by a validation, and any privilege it needs was confirmed |
| Constrained | The step needs a privilege the model could not confirm |
| Modeled | The step is modeled and needs no privilege the model could not confirm |
Reaching is not compromising. The modeled compromise of a jewel is the model's likelihood that an attacker gets there: for each entry, the likelihood of the route to the jewel, priced at the steps it takes, with each reaching step discounted by its rung; then combined across entries as if independent. A jewel three steps in is priced at three steps, never at the entry's likelihood. A path that reaches two jewels is one path for the organization figure, not two.
How modeled financial exposure is calculated
For each quantified impact of a jewel:
- the loss is the three-point figure, the downtime figure or the sum of components, whichever shape you gave;
- the likelihood is the jewel's modeled compromise, multiplied by the severe-outcome likelihood you stated or the model assumed;
- the modeled financial exposure of that impact is the likelihood times the loss.
The jewel's figure adds its impacts, and counts the response and recovery cost once: one compromise of one jewel is one incident, however many consequence categories it has. The organization's figure adds the jewels and again counts once the response and recovery that one modeled incident would share across the jewels it reaches. The figure is also broken down by the domain the paths enter through.
Three things the figure is not:
- Not a guaranteed loss and not an actuarial forecast. It is a modeled likelihood applied to your own estimate, under the model's assumptions, within the horizon.
- Not zero when you gave no numbers. A jewel with ratings but no quantified impact shows insufficient data, and an organization with no quantified jewel shows the same.
- Not converted. Jewels in different currencies make the organization figure absent and say so, rather than silently summing across currencies.
Which exposures reach which jewels
Every exposure that stands on a path can be asked which jewels it reaches and on which rung. The Remediation page shows this beside each remediation option, so a weakness that opens the route to a critical jewel is visible as such next to its SSVC priority and its severity, without any of the three being folded into the others.
Next
- Risk Posture - where jewels are designated, and the options that move them
- Modeled risk - what the figures mean
- Attack paths - how the routes are built