Instructor: Data Classification. 2 2
In this lesson, we're going to explore 3 3
the world of data classification, 4 4
and this all comes as part of data governance. 5 5
When we talk about data governance, 6 6
this is the process of managing information 7 7
over its lifecycle from creation to destruction. 8 8
So, as we start thinking about a piece of data, 9 9
if I wanted to create, let's say, a new video 10 10
that's a piece of data in my world, 11 11
well, first I have to create that video. 12 12
Now, when I create that video, I'm going to classify it 13 13
and I'm going to say what level this thing is, 14 14
and that's going to determine how it needs to be protected. 15 15
Then, we have to store that thing that I just created. 16 16
And in that storage we have to also think about security. 17 17
Are we going to encrypt it or not? 18 18
Are we going to use access controls or not? 19 19
How are we going to do backup and recovery operations? 20 20
All of that stuff is things that we have to think about 21 21
as part of storage. 22 22
Then, we start thinking about distribution. 23 23
How am I going to take that piece of data, 24 24
in my case of video, 25 25
and I'm going to make sure it gets out to the data consumers 26 26
who want to watch that or use that? 27 27
That is what we're talking about with distribution. 28 28
And then finally, we talk about retention or destruction. 29 29
And this is the end of the life cycle 30 30
because we're done with this piece of data, 31 31
we no longer need it. 32 32
For instance, this video is for a particular version 33 33
of the CySA+ exam. 34 34
If CySA+ is no longer a certification 35 35
or they move to a newer version, 36 36
I would end up destroying this video 37 37
because we don't need it anymore. 38 38
There's no reason to keep data infinitely. 39 39
Instead, you should have a retention period 40 40
and then delete it when you're done. 41 41
So, this is what we're talking about 42 42
when we talk about data governance, 43 43
and a large part of that is data classification. 44 44
As I said, data classification 45 45
is going to occur during the creation stage. 46 46
And when I talk about data classification, 47 47
this is the process of applying confidentiality 48 48
and privacy labels to that information. 49 49
Now, the best way to think about this 50 50
is if you think about any kind of military movie 51 51
you might have seen or a spy movie you might have seen, 52 52
somebody has a folder 53 53
and on the outside it's labeled top secret. 54 54
This tells you this tag is top secret. 55 55
This data needs to be protected a certain way 56 56
because it's top secret information. 57 57
That's what that tag or label is signifying. 58 58
Well, the same thing happens in our networks, 59 59
and there's lots of different classifications we can use. 60 60
Now, the most common scheme 61 61
is the military classification scheme, 62 62
which is unclassified, classified, confidential, 63 63
secret, and top secret. 64 64
Now, when we talk about unclassified, 65 65
this is a label that says there are no restrictions 66 66
on viewing that data. 67 67
This also presents no risk to our organization 68 68
if the information is disclosed to the public at large. 69 69
For instance, if you go to the US Army's website, 70 70
there's information on that site. 71 71
That is unclassified data, 72 72
it's something that they said, "We're okay 73 73
with everyone in the world knowing what this is." 74 74
A lot of the Army publications like their field manuals, 75 75
those are unclassified 76 76
and anyone around the world can download it, 77 77
read it, and learn about how the army does what it does. 78 78
Now, the next classification we have is classified, 79 79
and this is really our first controlled characteristic. 80 80
When we talk about classified, 81 81
this is viewing that is restricted to authorized persons 82 82
within the owner's organization 83 83
or third parties under a non-disclosure agreement. 84 84
Now, as I said, 85 85
we started with unclassified where everybody can see it. 86 86
Now we're in classified, 87 87
which means one of several categories. 88 88
In the military construct, 89 89
this is going to be confidential, secret, or top secret. 90 90
Now, as we go into confidential, 91 91
this is the lowest of the classified forms. 92 92
When we deal with confidential data, 93 93
this is highly sensitive data that is for viewing 94 94
only by approved persons within the organization 95 95
and possibly those who are trusted under an NDA. 96 96
Again, this is the lowest level of classification 97 97
inside the classified realm of the military system. 98 98
Then, we go up to secret. 99 99
This is information or data that is valuable, 100 100
and therefore it has to be protected 101 101
by severely restricting its viewing. 102 102
So, for instance, if you work with the military, 103 103
they have certain buildings where you can go 104 104
and view this secret information. 105 105
They have certain networks that will store this information, 106 106
and those networks don't connect to the internet 107 107
because the internet is unclassified. 108 108
And so, it has more protections and therefore more cost, 109 109
and that data is more valuable. 110 110
And then, we have the highest level in the military system, 111 111
and this is known as top secret. 112 112
Now, top secret information or data 113 113
is stuff that could have grave danger 114 114
if it was inadvertently disclosed. 115 115
So, for example, 116 116
when you're thinking in the military context, 117 117
if we knew where some bad guy was 118 118
and we were going up operation to go after that bad guy, 119 119
the location that bad guy is at 120 120
would be top secret information. 121 121
Only a few people would know it, 122 122
and only those who need it for their job 123 123
to be able to go do that mission to go get that bad guy. 124 124
We want to keep that information 125 125
as highly classified as possible. 126 126
Another thing might be if we had a list 127 127
of all the CIA agents around the world and their locations. 128 128
Well, that would be a top secret piece of information 129 129
because if that got out, 130 130
somebody could go target all those agents 131 131
and take them out, right? 132 132
And we wouldn't want that to happen 133 133
as the American government, 134 134
so therefore we would want to make sure that is protected 135 135
in our top secret enclaves. 136 136
Usually, in the military system, 137 137
they'll have a separate network 138 138
for the top secret stuff as well. 139 139
So, they have the unclassed network, the secret network, 140 140
and the top secret network. 141 141
And this way they can protect that data 142 142
at the different levels. 143 143
The higher the classification level of that data, 144 144
the more restrictions are going to be placed on it 145 145
and the fewer people who can access it. 146 146
Now, a lot of organizations, 147 147
they don't use this military system though. 148 148
If you work in the commercial sector, 149 149
you might see things with a different classification scheme 150 150
like public, private or internal, and restricted. 151 151
This is a lot simpler. 152 152
And again, all of these would be on the same network 153 153
in most organizations, unlike the military 154 154
which actually breaks it apart into those three networks. 155 155
When you have them all in the same network, 156 156
it's just a matter of what kind of protections 157 157
each of those is going to have. 158 158
Maybe it's a different encryption scheme, 159 159
maybe it's different access control rights. 160 160
Those are the kind of things you can do. 161 161
Now, as far as protecting this information, 162 162
that is up to your organization. 163 163
But some organizations actually have the power 164 164
of law behind them. 165 165
For instance, I use the example of the military, 166 166
which is part of the US government. 167 167
The US government actually has, 168 168
as part of our US laws, 169 169
that you cannot disclose classified information. 170 170
So, if you work for the government or the military 171 171
and you have access to the secret or top secret information 172 172
and you tell somebody about it 173 173
and you give them access to information 174 174
and they're not supposed to have access, 175 175
they can actually have different things happen to you 176 176
like fines, imprisonment, or even the death penalty 177 177
in some really bad cases. 178 178
If you happen to be a spy and collecting information 179 179
about the US and getting that information, 180 180
they can actually try you for treason 181 181
and they can actually put you to death under this law. 182 182
So, this is actually a big deal depending on where you work, 183 183
so you have to keep these things in mind 184 184
as a cybersecurity analyst. 185 185
So, now that we've talked 186 186
about the different levels of classification, 187 187
we talked about the importance of classifying things, 188 188
how do we actually apply those labels to the data? 189 189
Well, this can be applied either manually 190 190
or automatically to the data 191 191
depending on how your systems are done. 192 192
In a lot of systems, it is going to be set up automatically 193 193
based on certain dirty words as we call them. 194 194
So, as we get a document, 195 195
it's going to go through that document and say, "Oh, 196 196
I see the word bazooka. 197 197
Bazooka is a secret word 198 198
so therefore this document is now secret." 199 199
That would be an automatic way of doing things. 200 200
Manually is where I type up the document 201 201
and then as I'm typing up the document, 202 202
I would put my classification level on it 203 203
and say, "This is an unclassified document. 204 204
This is a secret document. 205 205
This is a top secret document." 206 206
And then, we apply the right protections based on that. 207 207
Now, when we talk about classification, 208 208
we also have to think about the other side, 209 209
which is declassification. 210 210
Again, this is the lifecycle from cradle to grave. 211 211
The cradle part, when we create something, we classify it. 212 212
And when we're ready to move this thing along, 213 213
it might be in the middle of its lifecycle 214 214
or the end of the lifecycle, we may declassify it. 215 215
Now, declassification is the downgrading 216 216
of a classification label over time 217 217
due to the information no longer requiring 218 218
the additional security protections 219 219
provided by that classification. 220 220
Let me give you a great example 221 221
which will explain why we need to declassify things. 222 222
For instance, let's say you are part of the planning team 223 223
who is planning the invasion at Normandy back in 1944. 224 224
This is the middle of World War II. 225 225
Well, this Operation Overlord, the invasion at Normandy, 226 226
is a great example of this because at the time 227 227
that plan and all of the documents 228 228
and orders that went with it was a top secret mission. 229 229
It was all highly classified. 230 230
In fact, it was a subcategory 231 231
of top secret called BIGOT, 232 232
which was the British Invasion 233 233
of German Occupied Territories. 234 234
Now, at that time, 235 235
it made a lot of sense to keep all that classified. 236 236
We wanted to make sure that the Germans 237 237
didn't know the US and the Brits 238 238
were coming to go into that area, 239 239
so it had to be classified. 240 240
Now, once the invasion was done, 241 241
did it need to be classified anymore? 242 242
Well, maybe, 243 243
that's a call that the classifiers have to make, 244 244
but at the time, probably in 1944 or 45, 245 245
you may have kept it classified. 246 246
But here we are 75 years later, 247 247
do you think it's still classified? 248 248
No, of course not. 249 249
You can go on the internet and read the entire thing. 250 250
You can go find online all the battle plans, 251 251
the different orders that were put out, 252 252
all of the information, 253 253
the different technologies they were going to use. 254 254
All of that that used to be classified as top secret 255 255
is now declassified because over time 256 256
the technology we had in World War II 257 257
is ancient technology at this point. 258 258
We have much better technologies 259 259
and much better tools and much better techniques, 260 260
and so those are now classified. 261 261
And so, those older ones have now been declassified, 262 262
and this allows them to now be at the unclassified level 263 263
where they can be on the public internet 264 264
and anyone around the world 265 265
can publicly get them and read them.