Why classify data

But this is no easy task. Every organization is different, and there is no one-size-fits-all data protection strategy. In the data classification schema, each category should detail the types of data to be included, the potential risks associated with compromise, and guidelines for handling the data.

There are endless ways to classify data, but most organizations categorize or bucket data as variations of a four-level data classification schema — public, private, confidential, and restricted. Implementing best practices ensures that organizations set themselves up for success with their data classification processes and gain the most value from them. They also want to avoid the pitfalls of data classification done wrong, which can create a lasting negative perception about this powerful data privacy process.

Some best practices for developing a robust and successful data classification policy include five steps. To learn more about data classification or talk to a leading expert, view the supporting resources below. Schedule a personalized demo with one of our data security experts to see Spirion data protection solutions in action. Protect sensitive information with a solution that is customizable to your organizational needs.

When your job is to protect sensitive data, you need the flexibility to choose solutions that support your security and privacy initiatives. Not knowing where sensitive client financial data resides and failing to take the right security precautions can be a costly mistake for your organization.

Find out how Data privacy is treated in your sector. Data Classification Guide What is data classification? Data classification basics How data classification works Compliance regulations overview Guidelines for data classification Data classification roles in the enterprise How to optimize data classification. What is data classification? Data classification basics. Why Classify Your Data? Improve data security Data classification enables organizations to safeguard sensitive corporate and customer data by answering the following critical questions: What sensitive data do we have IP, PHI, PII, credit card, etc.

Where does this sensitive data reside? Who can access, modify, and delete it? How will it affect our business if the data is leaked, destroyed, or improperly altered? Knowing the answers to these questions delivers several benefits, including: Decrease the sensitive data footprints, thereby, making data security more effective.

Reduces access to sensitive data to only approved users. Understand the criticality of different types of data, so they can be better protected. Install the right data protection technologies, such as encryption, data loss prevention DLP , and identity loss and protection ILP. Optimize costs without wasting resources on non- or less-critical data. Support regulatory compliance Data classification helps determine where regulated data is located across the enterprise, ensures that appropriate security controls are in place, and that the data is traceable and searchable, as required by compliance regulations.

This delivers these advantages: Ensures that sensitive data is handled appropriately for different regulations , such as medical, credit card, and personally identifiable information PII. Aids in the ability to maintain day-to-day compliance with all relevant rules, regulations, and privacy laws. Supports rapid retrieval of specific information within a set timeframe, which helps meet newer compliance rules.

Improves the opportunity to pass compliance audits. Boost business operation efficiency and lowers business risks From the time information is created until it is destroyed, data classification can help organizations ensure they are effectively protecting, storing, and managing their data.

This delivers the following benefits: Provides better insight into and control over the data that organizations hold and share. Enables more efficient access to and use of protected data across the organization. Facilitates risk management by helping organizations assess the value of their data and the impact of it being lost, stolen, misused, or compromised. Contributes valuable capabilities for record retention and legal discovery.

Challenges of Data Classification Almost every organization houses some types of sensitive data — often much more than they realize. Data classification can be expensive and cumbersome Few organizations are equipped to handle data classification by traditional manual methods. This creates several challenges, including: Sensitive data has the potential to become lost in data silos where it is undiscoverable and unprotected.

Mishandling of sensitive information can result in embarrassment for clients and loss of future revenue. Organizations can be fined and penalized for mishandling regulated data. Data and privacy concerns get put in line behind other pressing priorities, such as sales, marketing, expansion, and product expenses. Organizations are out of sync with ever-evolving compliance regulations. Companies make data classification overly complex, thereby, failing to produce practical results. Lack of enforcement of data privacy policies Many organizations have data classification policies that are theoretical rather than operational.

The challenge stems from overlooking answering critical questions such as: Are inappropriate data privacy discussions happening at the top levels in an organization?

Who is ultimately responsible for data privacy, and do they have the powers to implement and control solutions? Is sensitive and confidential information being shared with other entities? Are privacy and compliance policies being circumvented, either deliberately or inadvertently? The data lifecycle includes these six stages: Creation — Sensitive data is generated in multiple formats, including emails, Excel documents, Word documents, Google documents, social media, and websites.

Role-based use — Role-based security controls are applied to all sensitive data via tagging based on internal security policies and compliance rules. Storage — After every use, data is stored with access controls and encryption. Sharing — Data is constantly being shared among employees, customers, and partners from different devices and platforms. Permanently destroy — Significant amounts of data need to be destroyed to reduce the storage burden and improve overall data security.

Data Classification and Data Discovery Along with data classification, comprehensive data privacy and security programs include a wide variety of tasks.

How data classification works. Automated — Technology-driven solutions eliminate the risks of human intervention, including excessive time and errors, while adding persistence around-the-clock classification of all data. Hybrid — Human intervention provides context for data classification, while tools enable efficiency and policy enforcement.

Assessing Data Classification Levels Organizations typically design their own data classification models and categories. Another way to assess the value and risk of sensitive across an organization is to ask these key questions: Criticality — How important is the data for everyday operations and business continuity? Availability — Is timely and reliable access to the data important for the business?

Sensitivity — What is the potential impact on the business if the data is compromised? Integrity — How important is it to ensure that the data is not tampered with during storage or while in transit?

Retainability — How long must the data be retained according to regulatory requirements or industry standards? Types of Data to be Classified Almost every organization houses some type of sensitive data — often much more than they realize. Regulated Information Data that is regulated by compliance organizations is always sensitive, though to varying degrees, and should always be classified. Unregulated Information In many cases, unregulated data is highly sensitive and critical to protect. This includes: Authentication Information — Data used to prove the identity of an individual, system, or service, such as passwords, shared secrets, encryption keys, and hash tables.

Compliance regulations overview. The GDPR defines personal data as any information that can identify a natural person, directly or indirectly, such as: Names Identification numbers Location data Online identifiers One or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of the person To comply with the GDPR, organizations must classify data within a data inventory structure, including the following: Type of data financial information, health data, etc.

Basis for data protection personal or sensitive information Categories of the individuals involved customers, patients, etc. Calculating Classification The goal of information security, as stated in the University's Information Security Policy, is to protect the confidentiality, integrity and availability of Institutional Data. The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Availability Ensuring timely and reliable access to and use of information. The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. They're defined as follows: 1. Authentication Verifier An Authentication Verifier is a piece of information that is held in confidence by an individual and used to prove that the person is who they say they are. In some instances, an Authentication Verifier may be shared amongst a small group of individuals.

An Authentication Verifier may also be used to prove the identity of a system or service. Examples include, but are not limited to: Passwords Shared secrets Cryptographic private keys 2. Transmission media used to exchange information already in electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media because the information being exchanged did not exists in electronic form before the transmission.

Export Controlled Materials Export Controlled Materials is defined as any information or materials that are subject to United States export control regulations including, but not limited to, the Export Administration Regulations EAR published by the U.

Controlled Technical Information "CTI" Controlled Technical Information means "technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination" per DFARS Updated Purpose, Applies To and Definitions.

Sorted Appendix A so that terms appear in alphabetical order and added Covered Financial Information as a term. The definition itself was not modified. Added Authentication Verifier to Appendix A. Added table of contents. Report Concerns. Data should be classified as Restricted when the unauthorized disclosure, alteration or destruction of that data could cause a significant level of risk to the University or its affiliates. Data should be classified as Private when the unauthorized disclosure, alteration or destruction of that data could result in a moderate level of risk to the University or its affiliates.

Data should be classified as Public when the unauthorized disclosure, alteration or destruction of that data would result in little or no risk to the University and its affiliates. Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

An Authentication Verifier is a piece of information that is held in confidence by an individual and used to prove that the person is who they say they are. Examples include, but are not limited to: Passwords Shared secrets Cryptographic private keys. Data Classification is the labelling of data with tags that tell us its level of sensitivity.

By understanding the sensitivity of data, we can learn more about how your data travels; how it is created, stored, used and accessed — its journey. And, once you understand these things, it then becomes possible to secure that data, throughout its journey. When data is created, tags are added that explain the value of the data.

Like labelling boxes for a house move. These categorisations are applied to the data file in the same way that a file name is. These tags are created as metadata and can be visually stamped on the documents too. They travel with the document, wherever it goes, and can be read by other software to determine exactly what is in the document and how that data should be handled.

Once your data is classified you become empowered to find it, use it, protect it and monitor it effectively. Data Classification enables you to understand and secure the journey of your data, keeping it safe from conception to deletion. With the ability to manage and retrieve data more quickly and identify data for deletion more easily, a reduction in data storage costs can be realised. By classifying their data, organisations can comply with increasing and continually-evolving data legislation.

Data Classification provides the ability to discover and gain control of legacy data, not to mention protecting against data loss through the use of downstream security technologies.

Data Classification provides more control over who can consume different types of data.