Description
Identify the organization's most critical assets, the systems, data stores, and processes whose compromise would cause the greatest damage, and use this understanding to prioritize where deception coverage should be concentrated.
Rationale
Deception resources are finite. Spreading them uniformly across the entire environment dilutes their effectiveness. By identifying crown jewel assets, you can concentrate deception coverage on the paths adversaries must traverse to reach what matters most, creating a high-fidelity detection perimeter around your most valuable targets.
Supporting Basis
Direct antecedentMITRE Engage requires identification of critical cyber assets and points practitioners to Crown Jewels Analysis.
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Conduct asset inventory
Enumerate all systems, data stores, and processes across the organization. Include both IT and OT assets where applicable.
Classify by business impact
Assess each asset against business impact criteria: revenue impact, regulatory exposure, operational criticality, and reputational risk.
Map access paths
For each crown jewel asset, map the network paths and credential chains that an adversary would need to traverse to reach it.
Identify deception placement opportunities
Along each access path, identify locations where deception assets can be placed to detect adversaries moving toward crown jewels.
Technical Implementation Examples(1)
Crown Jewel Access Path Mapper
Script to document crown jewel assets and their network access paths for deception placement analysis
"""
Crown Jewel Identification and Access Path Mapping.
Outputs a structured report of critical assets with recommended
deception placement points along each access path.
"""
import json
from dataclasses import dataclass, field, asdict
from typing import List
@dataclass
class DeceptionPlacement:
location: str
asset_type: str # honeypot, canary, credential-trap, decoy-service
priority: str # critical, high, medium, low
rationale: str
@dataclass
class AccessPath:
name: str
hops: List[str]
authentication_required: List[str]
deception_placements: List[DeceptionPlacement] = field(
default_factory=list
)
@dataclass
class CrownJewel:
name: str
asset_type: str
business_impact: str # critical, high, medium
data_classification: str
access_paths: List[AccessPath] = field(default_factory=list)
def analyze_crown_jewels():
"""Build crown jewel inventory with access path analysis."""
assets = [
CrownJewel(
name="Production Customer Database",
asset_type="database-server",
business_impact="critical",
data_classification="pii-financial",
access_paths=[
AccessPath(
name="VPN to Database",
hops=[
"vpn-gateway",
"jump-host-01",
"app-server-tier",
"db-subnet",
],
authentication_required=[
"vpn-credentials",
"ssh-key",
"db-credentials",
],
deception_placements=[
DeceptionPlacement(
location="jump-host-subnet",
asset_type="honeypot",
priority="high",
rationale="First hop after VPN - catches "
"lateral movement early",
),
DeceptionPlacement(
location="db-subnet",
asset_type="decoy-database",
priority="critical",
rationale="Decoy DB adjacent to real DB "
"catches targeted access",
),
DeceptionPlacement(
location="app-server-config",
asset_type="credential-trap",
priority="critical",
rationale="Fake DB credentials in app "
"config files",
),
],
),
],
),
]
report = {
"assessment_type": "crown-jewel-access-path-analysis",
"assets": [asdict(a) for a in assets],
"summary": {
"total_crown_jewels": len(assets),
"total_access_paths": sum(
len(a.access_paths) for a in assets
),
"total_deception_placements": sum(
len(dp)
for a in assets
for p in a.access_paths
for dp in [p.deception_placements]
),
},
}
print(json.dumps(report, indent=2))
return report
if __name__ == "__main__":
analyze_crown_jewels()MITRE ATT&CK Mappings
| Technique | Tactic | Relationship |
|---|---|---|
| T1083File and Directory Discovery | Discovery | counters |
| T1082System Information Discovery | Discovery | counters |
Considerations
- Crown jewels may not be what leadership initially identifies. Database servers holding customer data are obvious targets, but the domain controller that provides access to everything is often the real crown jewel.
- Consider temporal criticality. Some assets are crown jewels only at certain times (e.g., financial systems during quarter-end processing).
Supported Environments
Tools & Resources
- Asset management platforms
- Network topology mapping tools
- Business impact analysis frameworks
- Attack path modeling tools (BloodHound for AD environments)
Quick Stats
- Phase
- Plan
- Difficulty
- intermediate
- Detection Value
- medium
- Cost
- minimal
- Time
- 1-2 weeks
- ATT&CK Mappings
- 2