Time money and hours courses are precious to us.
So we want to spend as little of our resources as possible on security.
Security is not the end goal.
The goal is to be getting on with the things that we want to actually do.
Maybe surfing the web or writing an email or running a business.
Most organizations are not in the business of security.
Security is simply an enabler to do business and to do the things that we want to do.
We don't want to do security for the sake of it.
We don't want to apply too much security or too little security.
We want to optimize our use of our resources so they optimally protect our assets.
I want you to get your best return on investment in terms of your resources when it comes to applying
security.
So the aim should be to protect what you value most and apply no security so that you can do the things
that you want to do safely online.
Also the business can function within acceptable levels of risk.
So let's now do a simple thought experiment either for yourself personally.
You can think about this for the thought experiment or you can think about maybe in the context of an
organization or service or application we're going to think about in the context of this thing that
you want to protect and sort of their files their e-mails their accounts and ask yourself what is most
confidential What can you afford to lose what is irreplaceable what could cause the most damage what
might impact your reputation we could think in terms of things like photos credit card details bank
account details personal identifiable information PIII account information maybe social media linked
teen Facebook Amazon PayPal your primary main e-mail accounts Bitcoin wallet and other cryptocurrency
wallets cryptocurrency Exchange account details browser history secret or confidential files and data
password information financial records.
Think about if they were stolen destroyed or encrypted so that you couldn't use them or get access to
them or may be placed on the Internet and revealed to everyone to see perhaps put in the hands of cyber
criminals and the potential they have to do something with them.
This thought experiment should start to guide you towards the things that are of most value to you or
the organization or the object that you are considering in the security context to apply effective security.
You must know what you value and how much you value it.
You must understand the security objectives for that asset.
For example do you not want it stolen.
Do you not want it destroyed.
Must it be available to you at all times.
The things that we value we refer to them as your security assets the things that we value your assets
as we go through the course you will apply security the assets that you value and you will concentrate
your security efforts on the assets that you value the most and that are at the greatest risk.
There's little point for example spending hours trying to back up files.
You can replace and not taking special care of files that you cannot you want for example to apply maybe
two factor authentication to accounts that you care about maybe not waste time with two factor authentication
on accounts of a little value.
So security has its context.
If you have assets in your mind now that you're thinking about as we've gone through the thought experiment
that you want to protect or considering protecting as a practical exercise right down those assets then
as you go through the course think about how you protect them with the security controls we discussed
or whether you can protect them with the security controls that we discuss and update your list as you
go through the course.