Many organizations fail to implement an effective information security program due to not properly classifying and labeling the data and assets.
It's the responsibility of an organization leadership to implement data and asset classification for limiting the data breaches, accidental loss of sensitive information and loss due to the additional cost associated with securing data that may not require it.
So what is Data Classification Policy? It is a standalone document or section in IS policy governing the process of labeling the information assets. Data classification implementation doesn't only limits to information, but it also comprises the hardware that process it and storage media. Data classification helps an organization to assign value to an asset based on its sensitivity, criticality to organization mission and purpose.
Photo Credits: Microsoft Pulse
Identify sensitive data for classification
Assigning the higher classification label to insensitive information results in a monetary loss to the organization and also assigning the lower classification to sensitive data may result in a data breach. Identifying the sensitivity and categorization of data is a crucial step for implementing a robust data classification policy.
Sensitive data can be identified by measuring the impact on the operations in case of the data breach. Industry standards and regulations also define the sensitivity of relative data.
The common type of sensitive data:
Payment Card Information and Financial Information are protected under GLBA and PCI DSS regulations to remain compliant.
Personally Identified Information (PII) should be protected and stored securely as it relates to an individual identity. GDPR and US States require the PII to be protected to remain compliant and organization may incur penalties for non-compliance.
Personal Health Information (PHI) is another kind of personal information that should be stored and shared in a secure manner to remain compliant to HIPAA/HITECH regulations.
Trade Secrets are the company's proprietary idea and important for their survival.
Next challenge is to define classifications and labels.
Typically organization classifies the data after the proper valuation which involves qualitative and qualitative analysis.
The information assets posing risk to the company's operations to halt and cause unrecoverable damage classified as Confidential.
The information assets which should stay within the organization perimeter and may result in serious legal issues are classified as Private.
The confidential information which doesn't pose any risk to operations upon loss may get classified as Sensitive.
Public information doesn't pose any risk to company operations and is meant for to release in public knowledge.
Implementing Data Classification
Stakeholders such as process owners within an organization should be instructed to identify the information assets and evaluate the risk associated with the assets in case of a breach. The process for identifying the critical assets that each process owner have access to should be documented for categorization.
Classification labels should be applied to information assets as per sensitivity. Often organization goes beyond the data classification by doing the classification of systems which stores, process and transmit sensitive and critically classified data.
Last but not least step is to secure the classified information assets by implementing security and technical controls. Policy and process controls may involve implementing the IT management framework such as COBIT, ISO 27001, etc and maintain compliance to regulators. Technical controls involve segregation of access via VLANs, Perimeter firewall, DMZ, etc.
Security Spoc™ experts had helped organizations from different industries to establish an effective Information Security Program to stay secure and remain compliant.