A laptop called information
Information asset – a laptop too far
An asset is most often defined as being something of value [to the business]; a resource that has economic value.
In accounting terms, ‘of economic value [to the business]’ means, a resource that has the ability to generate financial benefit [or loss].
An information asset could be defined as being a body of knowledge [information], a resource that has economic value, [benefit, or loss to the business]; where a body of knowledge is the collection of information gathered together in one or more places.
For example: an information asset [a body of knowledge] that is intellectual property [IP] could be said to have financial benefit; it is has economic beneficial value to the rightful owner. However, if other parties gain unlawful access to the IP for their financial benefit, this could impact upon the lawful owner’s rights. How important then is that IP to its rightful owner?
To put it another way; if the lawful owner of the IP does not put mechanisms in place to protect the resource [the IP in this case], what would be the consequence?
Some information could simply enable the business to function within legal and other boundaries, but yet still be referred to as an information asset.
For example, employee Information could benefit the business by enabling it to function effectively, and within data protection compliance boundaries. Therefore, any unlawful use [theft, destruction] of this information could result in regulatory action, and any action the employee may take. This could have negative economic consequences on the business [potential for loss]. Thus, this information is an asset, an information asset.
But what of the laptop? It is device that has been purchased [or leased] that is physical in nature; in use to enable the human being to access the digital world. Other uses are available, a doorstop for example.
Given a laptop; a word processing application; and a human being, the latter could select keys on the laptop keyboard to form symbols that eventually creates meaning [perhaps a letter to a customer]. Similar in many ways to taking a clean sheet of paper, and a pen to create the letter.
The letter, whether output to a sheet of paper or onto a laptop screen is formed of symbols that when taken as a whole conveys some meaning [information] to a reader [the author; the customer].
Are the paper/pen combination information assets? Are the laptop/word processor/screen combination information assets? Strangely enough no, they are simply tools.
Does the information [the letter] actually know its own worth, its value to the business? Most unlikely.
This being the case then, mechanisms to identify the information’s value should be considered. If the identification indicates high value, the next step in the process would be to ensure that other mechanisms are identified to protect the information.
Naturally this is based upon the fact that the information is unable to determine its own value or worth to the business. It should be noted that no A.I.s were harmed whilst forming that conclusion.
In summary:
- If information is identified as having economic value [benefit or loss], whether high or low, to the business it is an information asset, a resource having value.
- The information has zero knowledge of its own value. It simply sits there staring at you.
- The tools to create the information [pen/paper, laptop etc] are also assets; resources; tools.
- The paper/pen, laptop etc, do not know their true value either. They too sit staring at you until you use them to create, oh let’s see, information.
- The human being determines the information’s value, puts appropriate mechanisms in place for its protection, and by so doing recognises, perhaps, that physical assets are also in need of protection mechanisms.
- Knowing the type and whereabouts of information assets would be quite handy, as would knowing the relationship between them and their [physical] assets.
- The human being; the information assets; and the physical assets form part [!] of a whole – an information system, that needs mechanisms in place for its protection.
KanSecurity Ltd (NL)
