Details on the walkthrough/challenge can be found here.

Hands-on Walkthrough – Identifying Assets and Threats

Objective

Students will learn how to identify assets within an organization and understand the potential threats to these assets. They will practice identifying these elements in a real-world scenario.

Walkthrough Steps:

Introduction to Assets & Threats

Assets: Anything of value to the organization, such as databases, websites, intellectual property, physical devices, etc.
Threats: Potential dangers that could compromise the confidentiality, integrity, or availability of assets. Examples include cyber attacks, natural disasters, human error, or theft.

Scenario Setup

Present the students with a fictional organization:

"Nexus Corp is a cutting-edge tech conglomerate operating internationally. Specializing in AI-driven financial services, digital identity management, and blockchain-secured data storage, they cater to high-profile clients across government and corporate sectors. Their infrastructure includes a state-of-the-art AI research facility, customer-facing financial platforms, proprietary blockchain nodes for secure transactions, and a global data center network. They have an internal server for website hosting, a payment gateway integration, customer databases, and employee devices connected to the network."

Identifying Critical Assets

Ask students to list the critical assets for this company, for example:

Web Server (public-facing)
Multiple Database (stores sensitive customer data and internal data)
Payment Gateway (transaction processing)
Employee Devices (access to internal systems)
AI Research Facility (proprietary AI algorithms and research data)
Financial Services Platform (customer-facing web application)
Global Data Centers (storage and processing of client data)
Employee Workstations (access to internal systems and sensitive information)

Identifying Potential Threats

Introduce various types of threats and ask students to discuss how they might apply to each asset. For example:

Web Server: DDoS attack, SQL Injection, Cross-site Scripting (XSS)
Database: Data breach, SQL injection, unauthorized access
Payment Gateway: Man-in-the-middle attack, phishing attacks, fraud
Employee Devices: Malware, social engineering, insider threats

Mapping Assets to Threats

Have the students create a table or diagram mapping each identified asset to the corresponding threats. For example:

Asset	Potential Threats
Web Server	DDoS, SQL Injection, XSS
Database	Data Breach, SQL Injection, Unauthorized Access
Payment Gateway	Man-in-the-Middle, Phishing, Fraud
Employee Devices	Malware, Social Engineering, Insider Threats
AI Research Facility	Intellectual Property Theft, Insider Threats, Cyber Espionage
Financial Services Platform	DDoS, SQL Injection, Phishing
Blockchain Network	51% Attack, Unauthorized Access, Smart Contract Vulnerabilities
Global Data Centers	Data Breaches, Physical Sabotage, Malware
Employee Workstations	Malware, Social Engineering, Credential Theft

(in-class) Challenge 1 - Assets and Threats