Asset Importance

Asset Importance estimates the significance of a given asset (IP, domain, hostname, mobile application) to an organization. This importance is recalculated daily and may fluctuate as new data is processed. Importance levels range from Low to Critical, with specific assets categorized based on several key criteria.

Related data:

• Asset Risk Matrix
• Assets
• Attack Surface Analytics
• Finding Details
• Issue Tracking (SPM)
• Remediation (Continuous Monitoring)

Data Sources Used

Bitsight calculates asset importance using multiple data types, including:

• Passive DNS Data: Tracks DNS lookups to assess asset activity and usage.
• Web Crawling Data: Extracts information about web applications and services.
• Internet-Wide Scanning: Captures details on services and protocols exposed by assets.
• Device Activity Data: Identifies usage patterns of workstations and internet-connected devices.
• Threat Intelligence Data: Provides insights into compromised systems and botnet infections

These datasets provide insights into asset usage and interaction patterns, feeding into the algorithm that determines importance.

Importance Criteria

A number of factors are used in the algorithm to determine how assets are ranked by relative importance to the organization. The system regularly incorporates new data and recalculates it into asset importance daily. As a result, the calculated importance could change from day to day because of changes in the underlying inputs.

• We advise creating a user-assigned asset importance if you require a static asset importance.
• An asset of the highest importance within a subsidiary may not necessarily have a high importance relative to the other assets within a larger parent.

System Usage

The most notable contribution is the measurement of a system’s usage. The more distinct machines that are accessing a particular asset on the Internet are, the higher the importance of the asset. This is agnostic of the service or protocol used to access that system.

Egress IP

The IP address where the traffic on an organization’s endpoint devices exits their network onto the Internet are of higher importance.

Information Submission

Underutilized systems that contain sensitive data may pose a security risk, such as B2B applications or latent test or development systems. This factors in the website’s support for the user’s ability to submit information. It could take the form of mailing list enrollments, registration, login credentials, or any situation where the user is providing information to the server.

Service Classification

The type of service made available is evaluated, and the importance of its function is considered in its importance.

Example Service Categories: “Authentication protocols,” “Databases,” “System remote access,” “Network remote access,” “Communication services,” “Network infrastructure,” “ICS protocols,” “File exchange,” and “Mail systems,” among others.

Special Certificates

Systems that are provisioned with special certificates, known as “Extended Validation (EV) certificates,” are of high importance.

These metrics are processed through a weighted algorithm that assigns a rank to each asset, categorizing it into Low, Medium, High, or Critical importance.

Service Classification Importance

The type of service detected on an IP plays a major role in determining how important that asset is. Bitsight classifies services into predefined service groups, which are then mapped to an Asset Importance Category based on how risky they are when exposed.

Only the most sensitive service group funf on an IP is used to assign its Service Criticality, an input into the asset's final importance.

Domain-Based Asset Criteria

The following criteria are used for domain-based assets:

• System Usage
  • Measures how frequently distinct machines access a domain. This is calculated as the relative frequency of DNS lookups, with more frequently accessed domains given higher importance.
• Information Submission
  • Indicates whether the domain supports user-submitted data, such as forms for registrations or logins. Domains with user-submitted data are assigned a higher importance.
• Special Certificates
  • Recognizes the presence of Extended Validation (EV) certificates, which provide added security assurance and increase the importance score.

The final importance score for domain-based assets prioritizes System Usage as the main factor. If the domain is frequently accessed, it’s assigned a higher weight, with additional weight added from Information Submission and Special Certificates where applicable.

Asset Importance Evidence Insights

To provide greater transparency into how asset importance is calculated, the UI displays the underlying criteria used to compute importance scores. These data signals contribute to the calculated importance of each asset.

Domains:

The following criteria are used for IP-based assets:

• System Usage
  • Measures how frequently an IP is accessed and assigns higher importance to more frequently accessed IPs.
• Egress IP
  • Identifies IPs that are primary exit points for traffic from an organization’s network, especially those associated with endpoint devices. Egress IPs are given additional weight if they show high activity or signs of infection.
• Host Extension
  • Integrates the importance scores from related host assets, allowing an IP to inherit the associated host's highest importance score.
• Service Score
  • Assesses the importance of services running on the IP, such as databases or authentication protocols. It uses the weights described above.

The final importance of each IP-based asset is determined by using the highest value of these four criteria. Based on the calculated results, each asset is then mapped to a specific importance category.

Importance categories and their calculated numerical values:

Critical

0.1 and above

High

0.01 to 0.099

Medium

0.001 to 0.0099

Low

Below 0.001

None

null

The algorithm assigns an importance score by combining weighted values for specific criteria tailored for domain-based and IP-based assets. This separation ensures that each asset type is evaluated using relevant factors, with scores helping prioritize critical assets. The threshold filters out low-importance assets, focusing the results on those of higher importance.

Mobile Apps Asset Criteria

The importance of an app is determined by its number of downloads (for Android) or ratings (for iOS) compared to other apps from the same company.

• Special Cases
  • If the number of downloads / ratings is missing -> Medium 
  • If the number is zero -> Low 
  • If the company only has one app -> Medium
• When apps have similar numbers (the biggest and the smallest are not very far apart - less than 100x difference), the app’s importance depends on how many times bigger it is than the smallest one:
  • Less than 2x -> Low
  • 2-5x -> Medium
  • 5-10x -> High
  • 10x or more -> Critical
• When apps have very different numbers (100x or more gap), the app’s importance depends on what share it has of the most popular one:
  • Less than 0.1% -> Low
  • 0.1-1% -> Medium
  • 1-10% -> High
  • 10% or more -> Critical

The algorithm assigns an importance score by combining weighted values for specific criteria tailored for domain-based and IP-based assets. This separation ensures that each asset type is evaluated using relevant factors, with scores helping prioritize critical assets. The threshold filters out low-importance assets, focusing the results on those of higher importance.

Sampling and Thresholds in the Asset Importance Algorithm

The asset importance algorithm includes a sampling mechanism to ensure that the most relevant assets are highlighted. This approach helps users focus on high-impact assets by filtering out low-importance items and maintaining efficient processing.

• Limit on Assets per Entity: To maintain performance and clarity, there is a limit of 500,000 assets per entity. This cap helps prevent the system from being overwhelmed by an excessive number of assets while still providing a comprehensive view of high-priority infrastructure. For large organizations with extensive digital footprints, this limit balances detail with usability, ensuring that the list remains manageable and actionable.

Assigned Importance

Assigned Importance Types

User Importance

A user-assigned asset importance.

Users may assign an importance level to assets in their SPM companies (My Company, My Subsidiary, and subscribed companies in the same ratings tree as the My Company).

Calculated Importance

A Bitsight-calculated asset importance.

• The importance of user-assigned assets replaces the Bitsight-calculated asset importances any time importances are referenced (e.g., Assets, Asset Risk Matrix on the remediation tab, Attack Surface Analytics charts).
• User-assigned asset importance are contained within the entity in which they were assigned; They do not translate across the tree.
• User-assigned importances are visible to all users in your organization who can see the company where the asset importance was customized. They are not visible to any third parties monitoring your organization.

User-Assigned Importance Labels

User-assigned asset importances are labeled with a User icon near the asset importance section in the Assets tab. The following additional details are included:

Calculated Importance

The Bitsight-calculated asset importance.

Importance Updated

The date when the importance was assigned.

Updated By

The name of the editing user.

User Importance

The user-assigned asset importance.