This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Data Classification
Data Classification

Version management

Difference between version and

At line 1 added 101 lines
!!! Overview
[{$pagename}] ([Data Taxonomy]) is part of [Data Management] and is the [data] [taxonomy]
[{$pagename}] is the [classification] of [data] based on its level of sensitivity and the impact to the [Organizational Entity] or [Personal Entity] should that data be subject to [Disclosure-Alteration-Destruction] ([DAD]) without [authorization].
[{$pagename}] is required to:
* implement [Access Control]
* determine the [Releasability] of [data].
[{$pagename}] [SHOULD] to consider:
* the [Data Security Impact]
* [Data Provenance] and or [Data Pedigree].
* [Regulatory compliance] or [Standard Compliance|Standard compliance] some of which we have identified [IDM Related Compliance Items]
[{$pagename}] may be determined by [Trust Tiers] as used within [BeyondCorp]'s [Zero Trust] [architecture]
[{$pagename}] requires [Data Metadata] (Well in Our Humble Opinion)
!! [{$pagename}]
[{$pagename}] will vary depending each [Organizational Entity]'s circumstances. However there are various areas that should be considered.
* [Risk Assessment]
* [Data Constraint|Protected Data]
* [Data Disposal]
* [Data Protection]
!! [{$pagename}] types
[{$pagename}] types are wide and varied depending on the [context]
Some [{$pagename}] types could be:
* [Public data]
* [Sensitive Data]
* [Personal data]
* [Employee data]
* [Customer data]
* [Student data]
* [Biometric data]
* [Cardholder Data]
* [Personally Identifiable Information]
* [Protected Health Information]
* [Patient Data]
* [Company Confidential]
!! [Microsoft] [Azure] [{$pagename}] recommendations [4]
[Microsoft] recommends:
* [Personal data] - Not business related
* [Public data] - Business [Data] specifically prepared for [public Domain]
* General - (default) - Business [data] not intended for external partners
* [Confidential] - Business [data] that could cause an [unfortunate event] if shared with [unauthorized] [entities].
* Highly [Confidential] - appears to be [Personally Identifiable Information], [credential], [Health information] or [Intellectual Property]
These "tags" are recommended be used always and used within [Microsoft] products (ie Word, Excel etc) and they are working with [DLP] vendors to recognizes and take appropriate actions based on these "default" [{$pagename}]
!! [NIST.SP.800-63] [{$pagename}]
Making certain attribute values available to a [Relying Party] can carry [National Security] implications. In situations where this may be the case, identification of such [data] values at the time of exchange can be absolutely crucial to ensuring that they are appropriately handled and protected during [Data Management].
The [NIST] recommended values for use in [{$pagename}] are:
* [Unclassified] - Unclassified [data] carries no [National Security] implications. This does not, however, indicate that they are not sensitive, not in need of specific protections, or available publicly.
* [Controlled Unclassified Information] ([CUI])- These attribute values are not sensitive enough to have a negative impact on [National Security], but are none the less sensitive enough that they should be protected from improper access or exposure (e.g., [FOUO] information).
* [Confidential] - Attribute values, which if subject to [Confidentiality], could be expected to cause damage to [National Security].
* [secret] - Attribute values, which if subject to [Confidentiality], could be expected to cause serious damage to [National Security].
* [top-secret] - Attribute values, which if subject to [Confidentiality] could be expected to cause exceptionally grave damage to [National Security].
As with all classified information, the determination of the classification level for any [data] must be made by the appropriate U.S. Federal Government authority and the integrity of this classification must be maintained as the [data] is [transmitted|Data In Transit] or [stored|Data At Rest] in by IT systems.
!! [{$pagename}] [Examples]
While each [Entity] [{$pagename}] will be different it may be helpful to see [Example] [{$pagename}] as shown below.
The [{$pagename}] helps determine what baseline security controls are appropriate for safeguarding that [data]. All Organization data should be classified into one of three sensitivity levels, or classifications:
! Restricted Data [Example]
Data should be classified as Restricted when the unauthorized disclosure, alteration or destruction of that data could cause a significant level of risk to the Organization or its affiliates. Examples of Restricted data include:
* [Personally Identifiable Information]
* [IDM Related Compliance Items]
* Other [Governance Risk Management And Compliance] conditions
The highest level of security controls should be applied to Restricted data.
! [Private data] [Example]
Data should be classified as Private when the unauthorized disclosure, alteration or destruction of that data could result in a moderate level of risk to the Organization or its affiliates. By default, all Organization Data that is not explicitly classified as Restricted or Public data should be treated as Private data. A reasonable level of security controls should be applied to Private data.
! [Public data] [Example]
Data should be classified as Public when the unauthorized disclosure, alteration or destruction of that data would results in little or no risk to the University and its affiliates. Examples of Public data include press releases, sales brochures and advertising publications. While little or no controls are required to protect the [confidentiality] of Public data, some level of control is required to prevent unauthorized modification or destruction of Public data.
[{$pagename}] of data should be performed by an appropriate Data Steward. Data Stewards are senior-level employees of the Organization who oversee the [Data Management] of one or more sets of Organization Data.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Data Classification|Wikipedia:Data_classification_(data_management)|target='_blank'] - based on information obtained 2014-07-06
* [#2] - [NIST Internal Report 8112 (Draft) Attribute Metadata|http://csrc.nist.gov/publications/drafts/nistir-8112/nistir_8112_draft.pdf|target='_blank'] - based on information obtained 2017-01-01
* [#3] - [Classified_information_in_the_United_States|Wikipedia:Classified_information_in_the_United_States|target='_blank'] - based on information obtained 2017-01-10
* [#4] - [Classified_information_in_the_United_States|Wikipedia:Classified_information_in_the_United_States|target='_blank'] - based on information obtained 2017-02-21
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop