What a company guards in cyber security

What a company guards

A company guards anything that can be used to create value or cause loss. In cyber security the focus is on information, systems, and reputation. The assets include data (customer records, financial numbers), hardware (servers, laptops), software (applications, code), network pathways, and intangible assets such as brand trust. Protecting these items stops attackers from stealing, altering, or disrupting business.

How protection works, step by step

1. Identify assets – List everything that matters. A small online retailer might write down: customer email list, order database, payment-card processing service, website code, and the server that hosts the site.

2. Classify importance – Rank each asset by the impact of loss. Losing the email list may cause a spam problem, while a breach of payment data could bring fines and legal trouble. Assign labels such as low, medium, high.

3. Map threats – Ask what could happen to each asset. For the payment service, threats include credential theft, man-in-the-middle attacks, and ransomware that encrypts the database.

4. Apply controls – Choose technical and procedural safeguards. Encryption protects data at rest, firewalls filter network traffic, multi-factor authentication (MFA) blocks unauthorized logins, and regular backups limit damage from ransomware.

5. Monitor and respond – Set up alerts for unusual activity, keep logs, and have an incident-response plan ready. When a warning appears, the team follows the plan to contain and recover.

Worked example with concrete numbers

Imagine BrightBooks, a startup that sells digital planners. It has:

• 5 employees
• A cloud database that stores 2,000 customer records
• A payment gateway that processes $12,000 in sales each month
• Source code for the web app stored in a Git repository

Step 1 – Identify

BrightBooks writes down the four items above.

Step 2 – Classify

Asset	Impact if lost
Customer records (2,000 emails)	Medium – spam complaints, loss of trust
Payment data ($12,000/month)	High – legal penalties, financial loss
Source code	High – competitors could copy features
Employee laptops	Low – can be replaced

Step 3 – Map threats

• Customer records: accidental export, phishing of staff.
• Payment data: credential theft, API key leakage.
• Source code: unauthorized repository access.
• Laptops: theft, malware infection.

Step 4 – Controls

• Encrypt the database and require MFA for any access.
• Store API keys in a secret manager, rotate them monthly.
• Use branch protection rules in Git and require code reviews.
• Enable full-disk encryption on laptops and enforce strong passwords.

Step 5 – Monitor

BrightBooks sets up an alert that notifies the security lead if more than three failed login attempts occur on the database within ten minutes. It also backs up the database nightly to a separate cloud bucket.

If an alert fires, the team locks the account, checks logs, and restores from the latest backup if needed. This simple loop shows how a company can guard its most valuable pieces.

Common beginner mistakes

Mistake	Why it hurts
Treating all data the same	Wastes resources on low-risk items and leaves high-risk data exposed.
Relying only on passwords	Passwords can be guessed or stolen; MFA adds a second barrier.
Ignoring the human factor	Phishing attacks succeed when staff are not trained.
Skipping regular updates	Unpatched software is a common entry point for attackers.
Forgetting backups	Ransomware can encrypt files; without backups recovery is costly.

Beginners often assume that installing an antivirus is enough. In reality, protection is a layered approach that combines technology, policies, and people.

Standard textbook examples

1. Credit-card data – The Payment Card Industry Data Security Standard (PCI-DSS) requires encryption, network segmentation, and regular scans. A breach of card numbers can cost millions in fines.

2. Intellectual property – A software firm may hide its source code behind access controls and watermark binaries. If the code is leaked, competitors can copy features and erode market share.

Both examples illustrate why a company must know what it guards before choosing defenses.

Check yourself

1. Question: What are the three main categories of assets a company typically protects?
   Answer: Data, systems (hardware/software), and reputation/intangible assets.

2. Question: If a company encrypts its database but does not use MFA, what risk remains?
   Answer: An attacker who obtains valid credentials can still access the data despite encryption.

3. Question: Why are regular backups essential in a ransomware scenario?
   Answer: They allow the company to restore files without paying the attacker, limiting downtime.

Understanding what a company guards is the first step toward building a solid security posture. For more information, see the Bastion course and the article What is cyber security? – a clear definition.