Ldapwiki: Data Classification

More...

Overview#

Data Classification (Data Taxonomy) is part of Data Management and is the data taxonomy

Data Classification, in the context of Information Rights Management, is the classification of data based on its level of sensitivity and the impact to the Organizational Entity or Personal Entity should that data be subject to Disclosure-Alteration-Destruction (DAD) without authorization.

Data Classification may be dictated by Regulatory compliance or Standard Compliance some of which we have identified IDM Related Compliance Items

Data Classification may need to consider Data Provenance and or Data Pedigree.

Data Classification determines the Releasability of data.

Data Classification may be determined by Trust Tiers as used within BeyondCorp's Zero Trust architecture

Data Classification may be based on Releasability [2][3]

Data Metadata #

We also believe data should possess Metadata about the data content for proper Data Classification:

Data Provenance - Metadata relevant or pertaining to evaluating the source of the data's value
Data Accuracy - Metadata relevant or pertaining to determining if the data's value is correct
Data Currency - Metadata relevant or pertaining to determining the "freshness" of the specified data's value
Data Privacy - Metadata relevant or pertaining to privacy aspects of a given data's value
Data Classification - Metadata relevant or pertaining to the security Data Classification of the specified data's value

Data Classification types#

Data Classification types are wide and varied depending on the context

Some Data Classification types could be:

Microsoft Azure Data Classification recommendations [4]#

Microsoft recommends:

Personal data - Not business related
Public data - Business Data specifically prepared for public Domain
General - (default) - Business data not intended for external partners
Confidential - Business data that could cause an unfortunate event if shared with unauthorized entities.
Highly Confidential - appears to be Personally Identifiable Information, credential, Health information or Intellectual Property

These "tags" are recommended be used always and used within Microsoft products (ie Word, Excel etc) and they are working with DLP vendors to recognizes and take appropriate actions based on these "default" Data Classification

NIST.SP.800-63 Data Classification#

Making certain attribute values available to a Relying Party can carry National Security implications. In situations where this may be the case, identification of such data values at the time of exchange can be absolutely crucial to ensuring that they are appropriately handled and protected during Data Management.

The NIST recommended values for use in Data Classification are:

Unclassified - Unclassified data carries no National Security implications. This does not, however, indicate that they are not sensitive, not in need of specific protections, or available publicly.
Controlled Unclassified Information (CUI)- These attribute values are not sensitive enough to have a negative impact on National Security, but are none the less sensitive enough that they should be protected from improper access or exposure (e.g., FOUO information).
Confidential - Attribute values, which if subject to Confidentiality, could be expected to cause damage to National Security.
secret - Attribute values, which if subject to Confidentiality, could be expected to cause serious damage to National Security.
top-secret - Attribute values, which if subject to Confidentiality could be expected to cause exceptionally grave damage to National Security.

As with all classified information, the determination of the classification level for any data must be made by the appropriate U.S. Federal Government authority and the integrity of this classification must be maintained as the data is transmitted or stored in by IT systems.

Data Classification Examples #

While each Entity Data Classification will be different it may be helpful to see Example Data Classification as shown below.

The Data Classification helps determine what baseline security controls are appropriate for safeguarding that data. All Organization data should be classified into one of three sensitivity levels, or classifications:

Restricted Data Example #

Data should be classified as Restricted when the unauthorized disclosure, alteration or destruction of that data could cause a significant level of risk to the Organization or its affiliates. Examples of Restricted data include:

Personally Identifiable Information
IDM Related Compliance Items
Other Governance Risk Management And Compliance conditions

The highest level of security controls should be applied to Restricted data.

Private data Example #

Data should be classified as Private when the unauthorized disclosure, alteration or destruction of that data could result in a moderate level of risk to the Organization or its affiliates. By default, all Organization Data that is not explicitly classified as Restricted or Public data should be treated as Private data. A reasonable level of security controls should be applied to Private data.

Public data Example #

Data should be classified as Public when the unauthorized disclosure, alteration or destruction of that data would results in little or no risk to the University and its affiliates. Examples of Public data include press releases, sales brochures and advertising publications. While little or no controls are required to protect the confidentiality of Public data, some level of control is required to prevent unauthorized modification or destruction of Public data.

Data Classification of data should be performed by an appropriate Data Steward. Data Stewards are senior-level employees of the Organization who oversee the Data Management of one or more sets of Organization Data.