Business Context
Business Entities
Business Entities in Qualys ETM are logical representations of business units, applications, services, or other organizational areas that you want to monitor and manage for cybersecurity risk. They provide a business-oriented structure for organizing related assets and analyzing their aggregated risk.
Business Context
Business Context is the business-related information associated with assets that helps determine their relationship to a Business Entity and their importance to the organization. Business Context can include attributes such as business unit, application, service, owner, location, and other organizational details.
ETM associates relevant business context with Business Entities so that you can identify which assets support specific business areas and prioritize risk according to business significance.
Business Entities help you:
- Define acceptable risk levels and the potential financial impact of security incidents.
- Associate security findings with business and operational impact.
- Measure security risk in monetary terms.
Asset Tags and Business Entities
Asset Tags group and organize assets. Associating tags with a Business Entity enables ETM to connect tagged assets with the corresponding business context and provides a basis for understanding and assessing security risk for each business area. For more information, see Asset Tags.
Business Entity Configuration
By default, you can create up to 50 Business Entities. The limit can be changed for your subscription. For each entity, you can configure the following:
- General details: Name (required and unique; up to 45 characters; letters, numbers, spaces, hyphens, and underscores), title (up to 45 characters), description (required; up to 1,000 characters), location (country, state, and city), and one asset tag that identifies the entity's assets. A tag can be associated with only one business entity.
- Risk Quantification: Specify the business value of the entity, currency, and potential financial impact associated with security incidents.
- Risk Appetite: Define an acceptable risk level from 0 to 1,000, by using the risk appetite slider.
- Loss Magnitudes: Define the minimum and maximum financial impact for each loss type. ETM provides five system-defined loss types: Data Breach, Business Interruption, Fraud, Extortion, and Intellectual Property.
- A superuser can add custom loss types, up to 25 loss types in total. System-defined loss types cannot be renamed. The maximum impact of a loss type cannot exceed the business value of the entity.
For more information about creating a business entity, see Create Business Entity.
Understand Business Entity Through Example
Consider an organization that provides an Online Banking application. The organization creates Online Banking as a Business Entity in ETM to monitor the security risk associated with the application and its supporting assets.
The organization then defines the Business Context for Online Banking. For example, the application belongs to the Banking business unit, operates in the Production environment, and is owned by the Digital Banking Team. This context identifies the business significance of the assets supporting the application.
Next, the organization creates an asset tag named Online-Banking and applies it to the servers and databases supporting the application. The tag is then associated with the Online Banking Business Entity.
As a result, ETM can identify the assets supporting Online Banking, use their business context, and analyze their security risk as part of the Online Banking Business Entity.
Create Business Entities in ETM
See Create Business Entity for instructions on creating and configuring business entities.