1. A method comprising: storing enterprise objectives in a computer system; storing a list of enterprise resources in the computer system; mapping the enterprise objectives with the enterprise resources; removing enterprise resources from the list of enterprise resources that cannot be mapped to an enterprise objective to form a limited list of enterprise resources; filtering the limited list of resources using a value criterion, a rareness criterion, an inimitability criterion and a non-substitutability criterion to form a filtered list of enterprise resources; storing the filtered list of enterprise resources in the computer system; storing enterprise information assets in the computer system; mapping the enterprise information assets with enterprise resources from the filtered list; determining a threat analysis using an attack tree using the enterprise resources from the filtered list and the information assets comprising forming the attack tree using a data file that embeds an attack tree model, the attack tree defining possible attacks on the computer system modeled within a tree structure comprising nodal hierarchy allowing the decomposition and analysis of an attack within a number of attack steps, the attack tree using the enterprise resources from the filtered list as root nodes in the attack tree; and determining a risk value using the attack tree.