Data Classification and Protection: Know What You’re Protecting

 

Organizations collect and create enormous amounts of information.

Not all of that information requires the same level of protection.

A publicly available brochure does not need to be protected in the same way as employee records, financial information, passwords, or confidential customer information.

Data classification helps organizations determine how information should be handled based on its sensitivity and importance.

What Is Data Classification?

Data classification places information into categories so appropriate security controls can be applied.

Classification models differ between organizations, but common categories include:

Public -  Information intended for public distribution.

Internal -  Information intended primarily for organizational use.

Confidential -  Sensitive information requiring additional protection.

Restricted or Highly Confidential -  Information requiring the organization's strongest protections.

The exact labels are less important than understanding and following your organization's classification system.

Why Classification Matters

Without classification, employees may not know whether information can safely be:

• Emailed
• Printed
• Stored in the cloud
• Shared externally
• Copied to removable media
• Discussed publicly
• Accessed remotely

Classification connects information with appropriate handling requirements.

Data Owners and Custodians

Security+ distinguishes between different responsibilities surrounding information.

A data owner is generally responsible for determining the classification and protection requirements for information.

A data custodian is responsible for implementing or maintaining controls protecting that information.

Users also have responsibilities.

Employees who access information must follow the rules established for its handling.

Data States

Information can exist in different states.

Data at rest is stored information, such as files on a server.

Data in transit is information moving between systems.

Data in use is information actively being processed or accessed.

Security controls may differ depending on the state of the information.

Encryption, for example, can help protect both stored information and information being transmitted.

Handling Sensitive Information

Employees should understand where sensitive information may be stored.

Uploading a confidential document to an unapproved file-sharing service can create risk.

So can sending sensitive information through an unapproved communication platform.

Approved systems have generally been evaluated to determine whether appropriate security protections are available.

Verify Before Sending

One of the simplest data-protection habits is checking recipients before sending information.

Autocomplete can make email convenient, but it can also cause mistakes.

Before sending sensitive information:

Verify the recipient.

Verify attachments.

Verify whether the recipient is authorized to receive the information.

A few seconds of verification can prevent an accidental disclosure.

Printing Creates Data Too

Digital security often receives the most attention, but printed information also requires protection.

Sensitive documents should not be left unattended on printers, desks, conference-room tables, or other public locations.

Organizations may require secure disposal methods such as shredding or locked destruction containers.

Throwing sensitive documents into ordinary trash may expose information.

Data Retention

Keeping information forever is not necessarily safer.

Organizations often establish data retention policies defining how long particular records should be maintained.

Retention requirements may be influenced by operational, legal, regulatory, contractual, or historical requirements.

When information reaches the end of its approved retention period, it should be disposed of according to organizational requirements.

Secure Destruction

Deleting a file does not always mean the underlying information has been securely destroyed.

Organizations may use different destruction methods depending on the media involved.

These can include:

• Secure erasure
• Cryptographic erasure
• Physical destruction
• Shredding
• Approved media-destruction services

Employees should follow established procedures rather than improvising disposal methods.

Clean Desk and Clear Screen Practices

Sensitive information can also be exposed simply by being visible.

A clean-desk policy can reduce exposure of documents, credentials, and removable media.

Employees should also lock computers when leaving them unattended.

Even a short absence can create an opportunity for unauthorized access.

Data Loss Prevention

Organizations may use Data Loss Prevention (DLP) technologies to identify and control sensitive information.

DLP may help detect or prevent activities such as:

• Sending sensitive information externally
• Copying protected data to removable media
• Uploading data to unauthorized services

DLP supports employees, but technology should not replace good judgment.

Knowledge Check

1. What is data classification used for?

A. Determining how information should be protected
B. Increasing internet speed
C. Installing applications
D. Replacing backups

Answer: A

2. What is data in transit?

A. Archived information
B. Information moving between systems
C. Printed information
D. Deleted information

Answer: B

3. What should employees do before sending sensitive information?

A. Verify recipients and attachments
B. Disable encryption
C. Upload it publicly
D. Remove its classification

Answer: A

4. What does DLP stand for?

A. Digital Login Protection
B. Data Loss Prevention
C. Device Location Protocol
D. Distributed Login Policy

Answer: B

Security+ Quick Review

Data at Rest = Stored information

Data in Transit = Information being transmitted

Data in Use = Information actively being processed

Data Owner = Determines appropriate classification/protection requirements

Data Custodian = Maintains or implements protections

DLP = Technology used to help prevent unauthorized data disclosure

Final Takeaway

Before sharing, storing, printing, or disposing of information, understand what type of information you are handling.

You cannot protect information appropriately if you do not first understand its value and sensitivity.