I'm working on the SOA document.
I've previously defined our assets and have prepared the risk assessment.
In the SOA document I see the A.9.1.2 (access to networks and network services).
So far, I've defined assets like "commercial documents", "databases" and so on.
Accessing all these assets must of course be protected. So avoiding using public wifi networks will be specified in the Access Control Policy document.
My question is the following.
As using public wifi can be considered a valid thread for all IT assets we can access remotely, in the risk assessment list of item, can I just add a global asset called "internal IT resources" that will have the threat "using public wifi" and vulnerability being "public wifi networks are not secured by nature" ?
So this global asset would comprise other more specific assets.
Or do I have to specify this risk for all specific assets I've defined ?
When a risk is similar to several assets, you can create a single asset to represent them all and associate the risk to it, as you suggested.
For example, you do not need to record an organization's notebooks as individual assets (you can add an asset called "notebook"), but if they have specific purposes with different risk levels you can use specific assets like "notebook", "development notebook", and "finance notebook". The same concept applies to IT assets.