Overview
You cannot protect what you have not identified. Security starts by naming your assets (what has value) and understanding your adversaries (who might want to harm them, and why). This pairing drives every sensible security decision.
Learning objectives
- Define assets and give examples beyond "computers."
- Describe categories of adversaries and their motivations.
- Explain why matching defenses to realistic adversaries matters.
Core concept
An asset is anything of value worth protecting. Assets include the obvious (servers, laptops, databases) but also:
- Data — customer records, source code, credentials, intellectual property.
- Reputation and trust — often the most expensive thing to lose.
- Availability of a service — an online store that is down is losing money every minute.
An adversary (or threat actor) is any person or group that might act against those assets. Adversaries differ enormously in skill, resources, and intent.
How it works
Security teams describe adversaries by capability and motivation:
- Opportunistic criminals — run automated attacks for money (ransomware, credential theft). High volume, low targeting.
- Organized crime — better funded, more persistent, still profit-driven.
- Insiders — employees or contractors who misuse legitimate access, sometimes maliciously, often by accident.
- Hacktivists — motivated by a cause, aiming for disruption or embarrassment.
- Nation-state actors — the best-resourced and most patient, pursuing espionage or strategic goals.
Matching defenses to realistic adversaries is the point of threat modeling: a small blog and a defense contractor face very different threats and should invest differently.
Practical example
Imagine a small online shop. Its critical assets are customer payment data, the website's availability, and its reputation. Its most realistic adversaries are opportunistic criminals running automated scans, not nation-states. So the highest-value defenses are basic and boring: strong authentication, patching, backups, and not storing card data it does not need — not exotic anti-espionage measures.
Common mistakes
- Listing only hardware as assets and forgetting data, reputation, and availability.
- Defending against the scariest adversary instead of the likeliest one, wasting limited resources.
Key takeaways
- Assets are anything of value: data, availability, and reputation count, not just devices.
- Adversaries range from opportunistic criminals to nation-states, differing in skill and motive.
- Good security matches defenses to the adversaries you are realistically likely to face.
Check your understanding
- List three assets for a hospital that are not physical devices.
- Why might a small business reasonably not prioritize defenses against nation-state actors?