Often when you ask someone what is important on their network, they will say "Everything".  But that cannot be the case.  You have to determine your High Value Targets first.  A High Value Target is a device, system, database or resource that you cannot live without and still accomplish your mission.  If you look at this from a military perspective, it is the key targets that can win you or lose you the war.  This may seem like common sense, but strangely many people have not considered this.  We protect networks so they can accomplish some defined mission whether it be information sharing or business related as examples.  Too often its seems we forget the mission part and don't really factor it into why we are doing security; whether designing an infrastructure or monitoring that infrastructure.  It becomes just a checklist....IDS (check)...Firewall(check)...Antivirus(check)...logs(check)...but are you really focusing on what is critical?

To protect a network/resource properly, you have to know your High Value Targets. In order to do this, your going to have to talk with your different business areas that make up your company/organization and understand what is important to them and what risk are they willing to take.  It may be that you have to help guide them to even get them to understand what you are asking.  That is ok, because it shows them that you are concerned and your are willing to take the time to help them and help yourself learn.  If you don't understand what is important to the company/organization, then your ability to design or monitor an infrastructure effectively is greatly diminished.  I would venture to say that we do a better job understanding our High Value Targets when it comes to designing the infrastructure but we fail when it comes to understanding it in order to effectively monitor it.  If you asked all your analysts on your different shifts (or however your monitoring) what the top five High Value Targets were on your network, what answers would you get?  Would those answers line up with the business owners?  An attack or anomalous traffic toward one asset may not be that worrying, but what if its toward one of your High Value Targets? 

In today's world, the threat has become very tailored and very specific.  We have so much traffic to monitor on our infrastructures today that we have to have a tailored and structured approach to monitoring.  You have to know what has the priority when it comes to protecting and/or monitoring.   What can't the company/organization live without?  I can assure your that the attacker is trying to find or already knows your high value targets.  The real question is do you know what they are?