Crown Jewel Assets — Expanded Detail

Companion doc (DOCS-145). The canonical crown-jewel inventory and its CJ numbering are in §2 of the Cirius Group Threat Model. This companion reproduces the same CJ-1 through CJ-8 list with expanded detail (controls, blast radius, residual risk). When the two differ, the canonical threat model is authoritative.

Owner: Rory (Security Officer) Audience: Security Officer, engineering, incident responders, auditors Review frequency: Annual in December, plus whenever a material new system containing ePHI is added Last reviewed: April 2026

---

How crown jewels are chosen

A crown jewel asset meets at least one of these criteria:

1. PHI concentration — stores, processes, or routes significant volumes of ePHI
2. Identity authority — compromise gives an attacker privilege to impersonate any user or any workload
3. Infrastructure authority — compromise gives an attacker the ability to reshape the environment itself
4. Network authority — compromise gives an attacker visibility into or control over all east-west and north-south traffic
5. Recovery authority — compromise prevents or undermines our ability to recover from a prior compromise
6. Key material — holds encryption keys or secrets that, if exfiltrated, unlock encrypted data or access elsewhere

---

Inventory

Assets ranked by impact if compromised (worst first), matching canonical §2 of the threat model.

CJ-1 — DDE AVD environment (PHI / Medicare)

• Type: PHI access plane (Azure Virtual Desktop + published application)
• Category: 1 (PHI concentration), 2 (identity — DDE tenant)
• Location: Azure DDE tenant ciriusdde.com (ff1c5d68) — AVD host pool + published app serving Medicare patients
• Blast radius: Direct PHI exposure at scale. HHS Breach Notification Rule triggered. Loss of Medicare customer relationship. This is the single most sensitive asset in the environment — the reason Cirius has a HIPAA obligation at all.
• Existing controls: Separate DDE tenant (blast-radius isolation from PROD), Conditional Access with device compliance, Cortex XDR on AVD session hosts, Arctic Wolf visibility, DDE has its own break-glass, DDE SecOps agents report separately with source_system=DDE.
• Residual risk: HIGH until kill-chain agents are live across DDE and FIDO2 covers all privileged DDE accounts.

CJ-2 — Active Directory forests (ACTDIRAZP01 / ACTDIRAZP02 and DDE equivalents)

• Type: Identity authority (on-prem AD forests, all domain-joined workloads)
• Category: 2 (identity authority), 6 (stores KRBTGT and machine account passwords)
• Location: Azure PROD + Azure DDE
• Blast radius: Compromise of a DC yields domain-wide privilege. DCSync extracts every user's password hash and the KRBTGT key. With KRBTGT, an attacker forges Golden Tickets valid until KRBTGT is rotated twice. GPO modification lets the attacker push ransomware to every domain-joined host. Note: KRBTGT is inherently part of this crown jewel — it does not warrant a separate CJ entry because protecting the AD forests necessarily protects KRBTGT.
• Existing controls: Tier 0 isolation, DA membership restricted, Cortex XDR on DCs, Arctic Wolf visibility, 4662 SACL for DCSync (scheduled), 5136/5137 directory-service events, KRBTGT rotation cadence documented, break-glass rotation procedure.
• Residual risk: HIGH. DCSync detection and Pass-the-Hash detection agents in build.

CJ-3 — Terraform state (S3 + Azure Storage)

• Type: Infrastructure authority
• Category: 3 (infrastructure authority), 6 (contains secret outputs)
• Location: Azure Storage (azure-infra, azure-dde-infra, bedrock-hub) + S3 in each AWS account (aws-infra)
• Blast radius: The source-of-truth description of every cloud resource — identities, roles, network topology, secret references. State files contain resource IDs and, where providers leak them, sensitive attributes. A write-capable attacker can surreptitiously unmanage resources, hide them from drift detection, or prepare coordinated infrastructure changes that bypass PR review. A read-capable attacker maps the entire environment from a single file.
• Existing controls: State storage private; storage-account firewall restricts access to OIDC federated identities; AWS S3 versioning; Azure Storage soft-delete; access logs to LAW / CloudTrail; no local terraform apply permitted; every state change goes through PR + CI.
• Residual risk: MEDIUM. Key residual vector is OIDC identity compromise via a poisoned GitHub Action. Mitigated by SHA-pinning every Action.

CJ-4 — Veeam backup targets (AWS S3 Object Lock + RSV copies)

• Type: Recovery authority
• Category: 5 (recovery authority)
• Location: AWS S3 Object Lock (primary offsite, 2190-day retention) + Azure Recovery Services Vaults (secondary, immutability Unlocked)
• Blast radius: Without immutable backups after a ransomware event, the business pays or fails to recover. With them, recovery is possible. Ransomware actors specifically target backup infrastructure — destroying backups before encrypting production is standard RaaS TTP.
• Existing controls: S3 Object Lock (write-once 2190d, independent of Veeam state), RSV immutability, Veeam service account isolated from AD admin tier, dedicated management network, monthly restore spot-check, Q2 + Q4 DR tests scheduled.
• Residual risk: MEDIUM — DR test validates the actual recovery path.

CJ-5 — Palo Alto Panorama (+ 4 VM-Series enforcement nodes)

• Type: Network authority
• Category: 4 (network authority)
• Location: Panorama management VM + 4 VM-Series enforcement nodes
• Blast radius: Panorama compromise = attacker can alter security policy (allow egress, disable DNS Security), disable decryption, remove logging destinations, and effectively blind network-based detection. Does not directly touch PHI but removes the ability to see an attacker doing so.
• Existing controls: Management network isolated, named admin accounts with MFA, config backup on schedule (security/palo-alto-config-backup.md), credential rotation procedure (security/palo-alto-backup-credential-rotation.md), syslog shipped independent of Panorama to LAW, local break-glass per firewall.
• Residual risk: MEDIUM. Syslog redundancy means Panorama compromise is survivable, but policy-tampering window is real.

CJ-6 — psql-secops-prod (SecOps platform PostgreSQL)

• Type: PHI metadata / integrity of the incident and audit trail
• Category: 1 (PHI metadata concentration), 3 (infrastructure authority over detection)
• Location: Azure PROD, rg-logging-logs subscription, PostgreSQL 15 Flexible Server
• Blast radius: Every incident, finding, known-good rule, change ticket, and evidence reference. Tampered records destroy non-repudiability. A read-capable attacker sees every detection and suppression rule, enabling targeted evasion. Direct PHI volume is low but contextual significance is high.
• Existing controls: Private endpoint only, Entra AD authentication (no local SQL accounts), PITR 35d, CMK encryption, Palo Alto egress inspection, Defender for SQL, Keeper PAM session recording, break-glass suppression hard-blocked at API level. pgaudit live (enabled and streaming to LAW).
• Residual risk: MEDIUM until pgaudit-to-LAW DCR is verified flowing.

CJ-7 — cirius-openai-kv-prod (and CMK vaults)

• Type: Key material
• Category: 6 (key material)
• Location: Azure PROD — cirius-openai-kv-prod for app secrets, additional CMK vaults backing storage and KV-managed HSM
• Blast radius: CMK compromise enables decryption of data at rest for every resource using that key. App-secret compromise grants whatever the secret permits (SecOps API access, SecOps ingest, AI endpoints, third-party API credentials).
• Existing controls: Soft delete + purge protection, access via Entra identity only, diagnostic logs to LAW, quarterly rotation for application secrets, vault firewall, private endpoint where supported.
• Residual risk: MEDIUM. Key material is only as safe as the identity that can access it; RBAC and Conditional Access on workload identities is the mitigating layer.

CJ-8 — Break-glass accounts (18 total)

• Type: Identity (emergency)
• Category: 2 (identity authority)
• Location: On-prem AD (3), AWS root (7), Entra PROD (2), Entra DDE (2), Palo Alto local admin (4)
• Blast radius: Unauthorized use confers the highest privilege in the respective trust boundary. These accounts bypass MFA, PIM, and (in some cases) Conditional Access — highest-value target after KRBTGT.
• Existing controls: API-level hard block against suppression in SecOps (cannot be added to known-good rules), permanently unsuppressible audit rule, credentials stored in Keeper with split knowledge where feasible, physical safekeeping for offline credentials, any sign-in = immediate CRITICAL alert.
• Residual risk: LOW. Detection is guaranteed; the real risk is physical custody of the credentials.

---

Asset-to-threat mapping

Crown jewel	Primary threats	Detection coverage
CJ-1 DDE AVD	PHI exfiltration, ransomware via DDE	DDE kill-chain agents, Cortex XDR on session hosts, Arctic Wolf
CJ-2 AD forests	DCSync, Golden Ticket, Pass-the-Hash, GPO abuse	4662, 4624/4648, 5140 agents; Cortex XDR on DCs
CJ-3 Terraform state	Supply-chain poisoned Action, OIDC compromise	SHA-pinning; state access logs to LAW/CloudTrail
CJ-4 Veeam backups	Ransomware deletes backups before encryption	Veeam job monitoring; S3 Object Lock (delete-proof)
CJ-5 Panorama	Config tampering, admin takeover	Syslog to LAW, out-of-band backup, admin auth audit
CJ-6 psql-secops-prod	Unauthorized read/tamper, denial of audit trail	pgaudit to LAW, Defender for SQL, Keeper PAM session recording
CJ-7 Key Vaults	Unauthorized access, CMK exfiltration	KV diagnostic logs to LAW, RBAC audit
CJ-8 Break-glass	Unauthorized use	Permanently-unsuppressible rule, immediate CRITICAL

---

Document history

Date	Change	Author
April 2026	Initial crown jewel inventory	Kobe
June 2026	Align CJ numbering with canonical threat-model.md §2; fold KRBTGT into CJ-2; add CJ-1 DDE AVD and CJ-3 Terraform state	Kobe