- In 12.2, we're gonna talk about data classification.
Classification is the process of organizing assets
by either criticality or by sensitivity.
The sensitivity is based
on the impact of the assets exposure.
So if this asset was exposed to the public
or maybe just internally to the organization
or to a competitor, right what would be the impact?
That's sensitivity.
Criticality is based on the impact of the assets loss.
So operational criticality, right?
If this system wasn't available to us
what would be the impact?
And this criteria is often used
in disaster recovery and business continuity planning.
Asset classifications inform risk management decisions,
protection strategies, control decisions, audit scope
and regulatory compliance activities.
I can't stress enough how important going
through the classification process is
and accurately classifying all of our assets.
So let's look a little deeper into some
of the classification benefits in terms of security,
compliance, prioritization and cost efficiency.
By categorizing data, organizations can apply
the appropriate security measures such as encryption,
access control and monitoring.
Classifications can help organizations ensure,
right that regulations are being followed
by identifying which data falls under that particular domain
and applying the necessary controls.
And for prioritization,
classification can help organizations prioritize data
for backup, for retention and for disaster recovery.
And then there's cost efficiency.
Classifications can help organizations
make informed decisions about where to allocate resources
and invest in security measures.
Hopefully now you're convinced
that classification is a really important thing to do
with a myriad of benefits for an organization.
The classification designs vary by sector.
The number of and the type of classifications
in the private sector are discretionary.
Now by discretionary, I don't mean you can do it
or you don't have to do it.
I just mean how many of types of classifications,
a number of classifications and what they're called
are going to be discretionary.
Now, many companies will maybe do three levels,
some will do four levels, right?
They may be public, internal use only, confidential
and then protected or whatever it is
that you wanna use in your organization to describe them.
But whatever you're doing,
those classification levels should be defined
in policy and supported by standards.
And in our last module, module five
we'll talk a lot about those governance documents
about policies and standards.
Now generally, in government, in military agencies
in national security institutions, the number
and type of classifications you're gonna have are mandated.
And those classification labels are assigned
by classification officers based on predefined criteria.
So we have these mandated classification levels, right
in government, national security
and military agencies and institutions
and we have discretionary in the private sector.
Let me give you an example
of some national security classifications.
We may start at the lowest level
which is unclassified, information doesn't need
to be protected and may be released to the public.
Then we have controlled unclassified information,
which it's information that needs to be protected
and does require strict controls over its distribution.
Then we might have confidential, right
or disclosure expected to cause damage to national security.
And we might have secret, which is disclosure expected
to cause serious damage to national security.
And then top secret disclosure expected
to cause exceptionally grave danger to national security.
Now, all of these right, are based on the sensitivity
of the data, what would happen if that data was exposed.
A security clearance is a determination that is made
by the government or by military that an individual
is eligible to access classified information up
to a certain level of classification.
So it's only where we have these mandatory classifications
that we're also going to have what's known
as security clearance.
So we classify the data,
but we apply security clearance to individuals.
Now, I'm bringing it up here because it really ties
into data classifications
because clearance levels mirror data classification.
So you may have a clearance level
of top secret or secret or confidential.
Now, clearance is gonna be valid
for a specific amount of time and then must be renewed.
And clearance officers are responsible
for the clearance process.
There's a lot of background checking
and vetting that goes on.
I also wanna make sure that, I don't give you the impression
that just because you have a clearance level
you can get to all data that's classified at that level.
You also have to have a bonafide need to know.
And when we talk about access controls
a little bit later on,
we'll circle back to talking about clearance.
But I just wanted to introduce it here
because it does directly tie into talking
about classifications.
As I mentioned earlier, in the private sector
it's really discretionary how many levels
and types of classifications an organization wants to have.
But deciding upon the criticality
and the sensitivity classification categories
the definitions and the number of levels
is really a management function.
Now, classification categories should be codified in policy.
Our handling and protection standards
should be developed for each classification
and classification categories
and corresponding handling standards should be communicated
throughout the organization.
So let me give you an illustration
of a private sector classification.
We might have public
you say information that is for public consumption
for example a press release.
We may have internal use only, the information
that's widely available within the organization,
but not to be shared outside the organization.
So for example, an an ORG chart.
We might have confidential,
which is information that is sensitive or proprietary.
So for example, a trade secret.
And then we might have protected, which is information
that's governed by regulation or other obligations
like consumer financial account information.
So public, internal use only, confidential and protected.
It's up to each private sector organization to determine
what they wanna have, but this is a pretty common
or standard using four levels and defining them this way.
Now, it's really important that we communicate
to our user community as well as our custodians
those who are managing and monitoring, right the data
as well as anyone else that we might be sharing that data
with, right what the classification level is
and the way we accomplish that is by labeling.
Labeling is the vehicle for communicating
the assigned classification to custodians,
users and applications.
Now labels can take lots of forms.
They can be electronic, they can be print,
they can be audio, they could be visual.
They should always be appropriate for the intended audience.
So we wanna have them in the correct language
and in a way that they can easily be read and understood.
And labels are really important
because they transcend institutional knowledge.
So it's not like, oh yeah I should know that's confidential
or I should know that's top secret.
When it's labeled, we know what it is.
So it provides stability and continuity.
And those visual labels, right the visual,
I mean you can see them labels communicate to everyone
who might come in contact with that data, right
what the classification level is
and then what all the corresponding standards are
for how we're going to protect that data.
So what do we really mean by handling standards?
Handling standards inform custodians
and users how to protect the information that they use
and the systems that they interact with.
Now handling standards dictate by classification level
how information must be stored, transmitted,
communicated, access, retained and destroyed.
Our handling standards aren't just for people, right?
They also extend to automated tools such as our DLP
our data loss prevention solutions
and handling standards may also extend all the way
out to our incident management and our breach notification.
Well, that my friends, brings us
to a three-second challenge.
Five challenge questions, three-seconds each.
Let's do it.
This type of classification is based
on the impact of asset loss.
One, two, three.
It's gonna be criticality.
Number two, this type of classification is based
on the impact of asset exposure.
One, two, three.
It's gonna be sensitivity.
Number three, national security classification applied
when disclosure's expected
to cause exceptionally grave danger to national security.
One, two, three.
That would be top secret.
Number four, determination made by the government
that an individual is eligible
to access classified information up
to a certain level of classification.
One, two, three.
That's gonna be clearance.
And lastly, number five this is for communicating
the assigned classification to custodians,
users and applications.
One, two, three.
And this is labeling.
And labeling really is very, very important
Right, that brings us to a security-in-action.
So we can practically apply our knowledge.
And this one's about classification.
You work for a relatively small, privately owned company.
The company's expanding both in markets served
and geographically.
You're preparing a presentation for management
on why classification is integral to growth.
So what are you gonna tell them?
So this is interesting.
It's a small company, right?
So you're a small company,
probably have no classification system it sounds like.
Privately held, right?
So privately owned.
So it's not government, it's not military
it's not national security.
They are expanding both in the markets they serve
and the geographies.
So they're expanding market served and geographies.
And you need to convince management that why
we need to stop, step back and classify our data perhaps
in our systems before moving on.
And you wanna explain to them why it's gonna be so important
and so helpful to our growth.
So what are you gonna tell them?
Put me on pause, think about it,
write down some notes, come on back.
So here might be your presentation highlights
that there's a wide range of benefits from having
a comprehensive well-planned classification program,
including it'll inform our risk management decisions,
our protection strategies and our control decisions.
It'll communicate our resource
and our protection priorities.
It will support regulatory compliance and it will add value
by allocating resources efficiently to help us make
the right decision and allow us to communicate
those protection strategies to our communities.
Make sure that we're staying right in regulatory compliance,
that we're not in non-compliance which could result in fines
or loss of a license or in worse case, a jail time.
And we're gonna add value because we'll be allocating
our protection resources very efficiently.
That's what I would put in the presentation.
I bet that's what you put too.
Right, all of that is, oh, you know,
it's security-in-action.
It's a relatively small Word Cloud
but it's a really important Word Cloud.
So make sure again, you can speak
to all of these terms and concepts before you move on.
When you're ready, I'll see you in the next lesson.