1 1 00:00:00,210 --> 00:00:02,370 Data Classification. 2 2 00:00:02,370 --> 00:00:04,170 In this lesson, we're going to explore 3 3 00:00:04,170 --> 00:00:06,360 the world of data classification, 4 4 00:00:06,360 --> 00:00:09,270 and this all comes as part of data governance. 5 5 00:00:09,270 --> 00:00:11,220 When we talk about data governance, 6 6 00:00:11,220 --> 00:00:13,320 this is the process of managing information 7 7 00:00:13,320 --> 00:00:16,860 over its lifecycle from creation to destruction. 8 8 00:00:16,860 --> 00:00:18,750 So, as we start thinking about a piece of data, 9 9 00:00:18,750 --> 00:00:21,060 if I wanted to create, let's say, a new video 10 10 00:00:21,060 --> 00:00:23,010 that's a piece of data in my world, 11 11 00:00:23,010 --> 00:00:25,350 well, first I have to create that video. 12 12 00:00:25,350 --> 00:00:27,870 Now, when I create that video, I'm going to classify it 13 13 00:00:27,870 --> 00:00:30,030 and I'm going to say what level this thing is, 14 14 00:00:30,030 --> 00:00:33,060 and that's going to determine how it needs to be protected. 15 15 00:00:33,060 --> 00:00:35,940 Then, we have to store that thing that I just created. 16 16 00:00:35,940 --> 00:00:39,180 And in that storage we have to also think about security. 17 17 00:00:39,180 --> 00:00:40,470 Are we going to encrypt it or not? 18 18 00:00:40,470 --> 00:00:42,300 Are we going to use access controls or not? 19 19 00:00:42,300 --> 00:00:44,340 How are we going to do backup and recovery operations? 20 20 00:00:44,340 --> 00:00:46,920 All of that stuff is things that we have to think about 21 21 00:00:46,920 --> 00:00:48,540 as part of storage. 22 22 00:00:48,540 --> 00:00:50,850 Then, we start thinking about distribution. 23 23 00:00:50,850 --> 00:00:52,500 How am I going to take that piece of data, 24 24 00:00:52,500 --> 00:00:53,730 in my case of video, 25 25 00:00:53,730 --> 00:00:56,220 and I'm going to make sure it gets out to the data consumers 26 26 00:00:56,220 --> 00:00:58,410 who want to watch that or use that? 27 27 00:00:58,410 --> 00:01:00,480 That is what we're talking about with distribution. 28 28 00:01:00,480 --> 00:01:03,750 And then finally, we talk about retention or destruction. 29 29 00:01:03,750 --> 00:01:05,400 And this is the end of the life cycle 30 30 00:01:05,400 --> 00:01:06,900 because we're done with this piece of data, 31 31 00:01:06,900 --> 00:01:08,160 we no longer need it. 32 32 00:01:08,160 --> 00:01:10,860 For instance, this video is for a particular version 33 33 00:01:10,860 --> 00:01:12,870 of the CySA+ exam. 34 34 00:01:12,870 --> 00:01:15,510 If CySA+ is no longer a certification 35 35 00:01:15,510 --> 00:01:17,220 or they move to a newer version, 36 36 00:01:17,220 --> 00:01:18,990 I would end up destroying this video 37 37 00:01:18,990 --> 00:01:20,310 because we don't need it anymore. 38 38 00:01:20,310 --> 00:01:22,650 There's no reason to keep data infinitely. 39 39 00:01:22,650 --> 00:01:24,870 Instead, you should have a retention period 40 40 00:01:24,870 --> 00:01:26,220 and then delete it when you're done. 41 41 00:01:26,220 --> 00:01:27,270 So, this is what we're talking about 42 42 00:01:27,270 --> 00:01:28,650 when we talk about data governance, 43 43 00:01:28,650 --> 00:01:31,650 and a large part of that is data classification. 44 44 00:01:31,650 --> 00:01:33,120 As I said, data classification 45 45 00:01:33,120 --> 00:01:35,280 is going to occur during the creation stage. 46 46 00:01:35,280 --> 00:01:37,140 And when I talk about data classification, 47 47 00:01:37,140 --> 00:01:39,540 this is the process of applying confidentiality 48 48 00:01:39,540 --> 00:01:42,600 and privacy labels to that information. 49 49 00:01:42,600 --> 00:01:44,100 Now, the best way to think about this 50 50 00:01:44,100 --> 00:01:46,380 is if you think about any kind of military movie 51 51 00:01:46,380 --> 00:01:48,540 you might have seen or a spy movie you might have seen, 52 52 00:01:48,540 --> 00:01:49,470 somebody has a folder 53 53 00:01:49,470 --> 00:01:51,510 and on the outside it's labeled top secret. 54 54 00:01:51,510 --> 00:01:54,300 This tells you this tag is top secret. 55 55 00:01:54,300 --> 00:01:56,460 This data needs to be protected a certain way 56 56 00:01:56,460 --> 00:01:58,710 because it's top secret information. 57 57 00:01:58,710 --> 00:02:01,410 That's what that tag or label is signifying. 58 58 00:02:01,410 --> 00:02:03,330 Well, the same thing happens in our networks, 59 59 00:02:03,330 --> 00:02:06,060 and there's lots of different classifications we can use. 60 60 00:02:06,060 --> 00:02:07,260 Now, the most common scheme 61 61 00:02:07,260 --> 00:02:09,240 is the military classification scheme, 62 62 00:02:09,240 --> 00:02:12,900 which is unclassified, classified, confidential, 63 63 00:02:12,900 --> 00:02:14,613 secret, and top secret. 64 64 00:02:15,510 --> 00:02:17,610 Now, when we talk about unclassified, 65 65 00:02:17,610 --> 00:02:19,830 this is a label that says there are no restrictions 66 66 00:02:19,830 --> 00:02:21,480 on viewing that data. 67 67 00:02:21,480 --> 00:02:23,850 This also presents no risk to our organization 68 68 00:02:23,850 --> 00:02:27,120 if the information is disclosed to the public at large. 69 69 00:02:27,120 --> 00:02:29,610 For instance, if you go to the US Army's website, 70 70 00:02:29,610 --> 00:02:31,530 there's information on that site. 71 71 00:02:31,530 --> 00:02:33,000 That is unclassified data, 72 72 00:02:33,000 --> 00:02:34,620 it's something that they said, "We're okay 73 73 00:02:34,620 --> 00:02:37,110 with everyone in the world knowing what this is." 74 74 00:02:37,110 --> 00:02:39,750 A lot of the Army publications like their field manuals, 75 75 00:02:39,750 --> 00:02:41,370 those are unclassified 76 76 00:02:41,370 --> 00:02:43,590 and anyone around the world can download it, 77 77 00:02:43,590 --> 00:02:46,800 read it, and learn about how the army does what it does. 78 78 00:02:46,800 --> 00:02:49,440 Now, the next classification we have is classified, 79 79 00:02:49,440 --> 00:02:52,410 and this is really our first controlled characteristic. 80 80 00:02:52,410 --> 00:02:53,640 When we talk about classified, 81 81 00:02:53,640 --> 00:02:56,700 this is viewing that is restricted to authorized persons 82 82 00:02:56,700 --> 00:02:58,440 within the owner's organization 83 83 00:02:58,440 --> 00:03:01,830 or third parties under a non-disclosure agreement. 84 84 00:03:01,830 --> 00:03:02,663 Now, as I said, 85 85 00:03:02,663 --> 00:03:05,220 we started with unclassified where everybody can see it. 86 86 00:03:05,220 --> 00:03:06,480 Now we're in classified, 87 87 00:03:06,480 --> 00:03:08,820 which means one of several categories. 88 88 00:03:08,820 --> 00:03:10,110 In the military construct, 89 89 00:03:10,110 --> 00:03:13,500 this is going to be confidential, secret, or top secret. 90 90 00:03:13,500 --> 00:03:14,700 Now, as we go into confidential, 91 91 00:03:14,700 --> 00:03:17,400 this is the lowest of the classified forms. 92 92 00:03:17,400 --> 00:03:19,140 When we deal with confidential data, 93 93 00:03:19,140 --> 00:03:21,420 this is highly sensitive data that is for viewing 94 94 00:03:21,420 --> 00:03:24,180 only by approved persons within the organization 95 95 00:03:24,180 --> 00:03:26,940 and possibly those who are trusted under an NDA. 96 96 00:03:26,940 --> 00:03:29,610 Again, this is the lowest level of classification 97 97 00:03:29,610 --> 00:03:33,510 inside the classified realm of the military system. 98 98 00:03:33,510 --> 00:03:35,220 Then, we go up to secret. 99 99 00:03:35,220 --> 00:03:37,560 This is information or data that is valuable, 100 100 00:03:37,560 --> 00:03:39,270 and therefore it has to be protected 101 101 00:03:39,270 --> 00:03:41,460 by severely restricting its viewing. 102 102 00:03:41,460 --> 00:03:43,440 So, for instance, if you work with the military, 103 103 00:03:43,440 --> 00:03:45,240 they have certain buildings where you can go 104 104 00:03:45,240 --> 00:03:47,340 and view this secret information. 105 105 00:03:47,340 --> 00:03:49,920 They have certain networks that will store this information, 106 106 00:03:49,920 --> 00:03:51,780 and those networks don't connect to the internet 107 107 00:03:51,780 --> 00:03:53,850 because the internet is unclassified. 108 108 00:03:53,850 --> 00:03:56,790 And so, it has more protections and therefore more cost, 109 109 00:03:56,790 --> 00:03:58,950 and that data is more valuable. 110 110 00:03:58,950 --> 00:04:01,290 And then, we have the highest level in the military system, 111 111 00:04:01,290 --> 00:04:03,030 and this is known as top secret. 112 112 00:04:03,030 --> 00:04:05,010 Now, top secret information or data 113 113 00:04:05,010 --> 00:04:06,960 is stuff that could have grave danger 114 114 00:04:06,960 --> 00:04:08,970 if it was inadvertently disclosed. 115 115 00:04:08,970 --> 00:04:10,080 So, for example, 116 116 00:04:10,080 --> 00:04:12,120 when you're thinking in the military context, 117 117 00:04:12,120 --> 00:04:14,340 if we knew where some bad guy was 118 118 00:04:14,340 --> 00:04:17,310 and we were going up operation to go after that bad guy, 119 119 00:04:17,310 --> 00:04:19,110 the location that bad guy is at 120 120 00:04:19,110 --> 00:04:20,700 would be top secret information. 121 121 00:04:20,700 --> 00:04:22,290 Only a few people would know it, 122 122 00:04:22,290 --> 00:04:24,210 and only those who need it for their job 123 123 00:04:24,210 --> 00:04:26,790 to be able to go do that mission to go get that bad guy. 124 124 00:04:26,790 --> 00:04:28,020 We want to keep that information 125 125 00:04:28,020 --> 00:04:30,270 as highly classified as possible. 126 126 00:04:30,270 --> 00:04:31,800 Another thing might be if we had a list 127 127 00:04:31,800 --> 00:04:34,860 of all the CIA agents around the world and their locations. 128 128 00:04:34,860 --> 00:04:36,840 Well, that would be a top secret piece of information 129 129 00:04:36,840 --> 00:04:38,280 because if that got out, 130 130 00:04:38,280 --> 00:04:39,990 somebody could go target all those agents 131 131 00:04:39,990 --> 00:04:41,040 and take them out, right? 132 132 00:04:41,040 --> 00:04:42,540 And we wouldn't want that to happen 133 133 00:04:42,540 --> 00:04:43,590 as the American government, 134 134 00:04:43,590 --> 00:04:46,080 so therefore we would want to make sure that is protected 135 135 00:04:46,080 --> 00:04:47,940 in our top secret enclaves. 136 136 00:04:47,940 --> 00:04:49,440 Usually, in the military system, 137 137 00:04:49,440 --> 00:04:50,790 they'll have a separate network 138 138 00:04:50,790 --> 00:04:52,560 for the top secret stuff as well. 139 139 00:04:52,560 --> 00:04:54,960 So, they have the unclassed network, the secret network, 140 140 00:04:54,960 --> 00:04:56,490 and the top secret network. 141 141 00:04:56,490 --> 00:04:57,990 And this way they can protect that data 142 142 00:04:57,990 --> 00:04:59,460 at the different levels. 143 143 00:04:59,460 --> 00:05:01,410 The higher the classification level of that data, 144 144 00:05:01,410 --> 00:05:03,240 the more restrictions are going to be placed on it 145 145 00:05:03,240 --> 00:05:05,550 and the fewer people who can access it. 146 146 00:05:05,550 --> 00:05:06,930 Now, a lot of organizations, 147 147 00:05:06,930 --> 00:05:08,730 they don't use this military system though. 148 148 00:05:08,730 --> 00:05:10,440 If you work in the commercial sector, 149 149 00:05:10,440 --> 00:05:12,960 you might see things with a different classification scheme 150 150 00:05:12,960 --> 00:05:16,170 like public, private or internal, and restricted. 151 151 00:05:16,170 --> 00:05:17,220 This is a lot simpler. 152 152 00:05:17,220 --> 00:05:19,620 And again, all of these would be on the same network 153 153 00:05:19,620 --> 00:05:21,780 in most organizations, unlike the military 154 154 00:05:21,780 --> 00:05:24,270 which actually breaks it apart into those three networks. 155 155 00:05:24,270 --> 00:05:25,650 When you have them all in the same network, 156 156 00:05:25,650 --> 00:05:27,240 it's just a matter of what kind of protections 157 157 00:05:27,240 --> 00:05:28,650 each of those is going to have. 158 158 00:05:28,650 --> 00:05:30,030 Maybe it's a different encryption scheme, 159 159 00:05:30,030 --> 00:05:32,100 maybe it's different access control rights. 160 160 00:05:32,100 --> 00:05:33,900 Those are the kind of things you can do. 161 161 00:05:33,900 --> 00:05:36,210 Now, as far as protecting this information, 162 162 00:05:36,210 --> 00:05:37,980 that is up to your organization. 163 163 00:05:37,980 --> 00:05:40,260 But some organizations actually have the power 164 164 00:05:40,260 --> 00:05:41,730 of law behind them. 165 165 00:05:41,730 --> 00:05:43,680 For instance, I use the example of the military, 166 166 00:05:43,680 --> 00:05:45,390 which is part of the US government. 167 167 00:05:45,390 --> 00:05:47,010 The US government actually has, 168 168 00:05:47,010 --> 00:05:49,170 as part of our US laws, 169 169 00:05:49,170 --> 00:05:51,330 that you cannot disclose classified information. 170 170 00:05:51,330 --> 00:05:54,180 So, if you work for the government or the military 171 171 00:05:54,180 --> 00:05:56,940 and you have access to the secret or top secret information 172 172 00:05:56,940 --> 00:05:58,200 and you tell somebody about it 173 173 00:05:58,200 --> 00:05:59,760 and you give them access to information 174 174 00:05:59,760 --> 00:06:01,410 and they're not supposed to have access, 175 175 00:06:01,410 --> 00:06:03,870 they can actually have different things happen to you 176 176 00:06:03,870 --> 00:06:07,290 like fines, imprisonment, or even the death penalty 177 177 00:06:07,290 --> 00:06:09,000 in some really bad cases. 178 178 00:06:09,000 --> 00:06:11,160 If you happen to be a spy and collecting information 179 179 00:06:11,160 --> 00:06:13,470 about the US and getting that information, 180 180 00:06:13,470 --> 00:06:15,390 they can actually try you for treason 181 181 00:06:15,390 --> 00:06:17,760 and they can actually put you to death under this law. 182 182 00:06:17,760 --> 00:06:20,850 So, this is actually a big deal depending on where you work, 183 183 00:06:20,850 --> 00:06:22,440 so you have to keep these things in mind 184 184 00:06:22,440 --> 00:06:24,750 as a cybersecurity analyst. 185 185 00:06:24,750 --> 00:06:25,980 So, now that we've talked 186 186 00:06:25,980 --> 00:06:27,870 about the different levels of classification, 187 187 00:06:27,870 --> 00:06:30,390 we talked about the importance of classifying things, 188 188 00:06:30,390 --> 00:06:33,390 how do we actually apply those labels to the data? 189 189 00:06:33,390 --> 00:06:35,430 Well, this can be applied either manually 190 190 00:06:35,430 --> 00:06:37,170 or automatically to the data 191 191 00:06:37,170 --> 00:06:39,210 depending on how your systems are done. 192 192 00:06:39,210 --> 00:06:42,360 In a lot of systems, it is going to be set up automatically 193 193 00:06:42,360 --> 00:06:44,790 based on certain dirty words as we call them. 194 194 00:06:44,790 --> 00:06:46,350 So, as we get a document, 195 195 00:06:46,350 --> 00:06:48,150 it's going to go through that document and say, "Oh, 196 196 00:06:48,150 --> 00:06:50,100 I see the word bazooka. 197 197 00:06:50,100 --> 00:06:51,210 Bazooka is a secret word 198 198 00:06:51,210 --> 00:06:53,250 so therefore this document is now secret." 199 199 00:06:53,250 --> 00:06:55,410 That would be an automatic way of doing things. 200 200 00:06:55,410 --> 00:06:57,510 Manually is where I type up the document 201 201 00:06:57,510 --> 00:06:59,400 and then as I'm typing up the document, 202 202 00:06:59,400 --> 00:07:01,050 I would put my classification level on it 203 203 00:07:01,050 --> 00:07:03,240 and say, "This is an unclassified document. 204 204 00:07:03,240 --> 00:07:04,500 This is a secret document. 205 205 00:07:04,500 --> 00:07:06,150 This is a top secret document." 206 206 00:07:06,150 --> 00:07:08,790 And then, we apply the right protections based on that. 207 207 00:07:08,790 --> 00:07:10,500 Now, when we talk about classification, 208 208 00:07:10,500 --> 00:07:11,820 we also have to think about the other side, 209 209 00:07:11,820 --> 00:07:13,350 which is declassification. 210 210 00:07:13,350 --> 00:07:16,050 Again, this is the lifecycle from cradle to grave. 211 211 00:07:16,050 --> 00:07:18,780 The cradle part, when we create something, we classify it. 212 212 00:07:18,780 --> 00:07:20,550 And when we're ready to move this thing along, 213 213 00:07:20,550 --> 00:07:22,110 it might be in the middle of its lifecycle 214 214 00:07:22,110 --> 00:07:25,110 or the end of the lifecycle, we may declassify it. 215 215 00:07:25,110 --> 00:07:27,360 Now, declassification is the downgrading 216 216 00:07:27,360 --> 00:07:29,700 of a classification label over time 217 217 00:07:29,700 --> 00:07:31,650 due to the information no longer requiring 218 218 00:07:31,650 --> 00:07:33,330 the additional security protections 219 219 00:07:33,330 --> 00:07:35,490 provided by that classification. 220 220 00:07:35,490 --> 00:07:36,690 Let me give you a great example 221 221 00:07:36,690 --> 00:07:39,690 which will explain why we need to declassify things. 222 222 00:07:39,690 --> 00:07:42,300 For instance, let's say you are part of the planning team 223 223 00:07:42,300 --> 00:07:46,020 who is planning the invasion at Normandy back in 1944. 224 224 00:07:46,020 --> 00:07:47,760 This is the middle of World War II. 225 225 00:07:47,760 --> 00:07:50,670 Well, this Operation Overlord, the invasion at Normandy, 226 226 00:07:50,670 --> 00:07:53,010 is a great example of this because at the time 227 227 00:07:53,010 --> 00:07:54,870 that plan and all of the documents 228 228 00:07:54,870 --> 00:07:57,660 and orders that went with it was a top secret mission. 229 229 00:07:57,660 --> 00:07:59,610 It was all highly classified. 230 230 00:07:59,610 --> 00:08:01,500 In fact, it was a subcategory 231 231 00:08:01,500 --> 00:08:02,913 of top secret called BIGOT, 232 232 00:08:04,170 --> 00:08:05,490 which was the British Invasion 233 233 00:08:05,490 --> 00:08:07,680 of German Occupied Territories. 234 234 00:08:07,680 --> 00:08:09,120 Now, at that time, 235 235 00:08:09,120 --> 00:08:11,580 it made a lot of sense to keep all that classified. 236 236 00:08:11,580 --> 00:08:13,560 We wanted to make sure that the Germans 237 237 00:08:13,560 --> 00:08:15,270 didn't know the US and the Brits 238 238 00:08:15,270 --> 00:08:17,190 were coming to go into that area, 239 239 00:08:17,190 --> 00:08:19,140 so it had to be classified. 240 240 00:08:19,140 --> 00:08:21,300 Now, once the invasion was done, 241 241 00:08:21,300 --> 00:08:23,100 did it need to be classified anymore? 242 242 00:08:23,100 --> 00:08:23,933 Well, maybe, 243 243 00:08:23,933 --> 00:08:25,620 that's a call that the classifiers have to make, 244 244 00:08:25,620 --> 00:08:28,830 but at the time, probably in 1944 or 45, 245 245 00:08:28,830 --> 00:08:30,360 you may have kept it classified. 246 246 00:08:30,360 --> 00:08:32,400 But here we are 75 years later, 247 247 00:08:32,400 --> 00:08:34,050 do you think it's still classified? 248 248 00:08:34,050 --> 00:08:35,460 No, of course not. 249 249 00:08:35,460 --> 00:08:38,190 You can go on the internet and read the entire thing. 250 250 00:08:38,190 --> 00:08:40,710 You can go find online all the battle plans, 251 251 00:08:40,710 --> 00:08:42,480 the different orders that were put out, 252 252 00:08:42,480 --> 00:08:43,313 all of the information, 253 253 00:08:43,313 --> 00:08:45,150 the different technologies they were going to use. 254 254 00:08:45,150 --> 00:08:47,820 All of that that used to be classified as top secret 255 255 00:08:47,820 --> 00:08:50,550 is now declassified because over time 256 256 00:08:50,550 --> 00:08:52,590 the technology we had in World War II 257 257 00:08:52,590 --> 00:08:54,300 is ancient technology at this point. 258 258 00:08:54,300 --> 00:08:55,740 We have much better technologies 259 259 00:08:55,740 --> 00:08:58,110 and much better tools and much better techniques, 260 260 00:08:58,110 --> 00:08:59,730 and so those are now classified. 261 261 00:08:59,730 --> 00:09:02,460 And so, those older ones have now been declassified, 262 262 00:09:02,460 --> 00:09:05,190 and this allows them to now be at the unclassified level 263 263 00:09:05,190 --> 00:09:06,750 where they can be on the public internet 264 264 00:09:06,750 --> 00:09:07,950 and anyone around the world 265 265 00:09:07,950 --> 00:09:09,813 can publicly get them and read them.