1 00:00:00,000 --> 00:00:01,763 In this lesson, we are going to talk 2 00:00:01,763 --> 00:00:04,440 a bit more in depth about the concept 3 00:00:04,440 --> 00:00:06,510 of data classifications. 4 00:00:06,510 --> 00:00:08,550 We are going to formally define them 5 00:00:08,550 --> 00:00:11,130 to ensure that you're ready for any questions you get 6 00:00:11,130 --> 00:00:13,590 about data classifications on the exam. 7 00:00:13,590 --> 00:00:16,440 Data classification is based on the value 8 00:00:16,440 --> 00:00:20,130 to the organization and the sensitivity of the information 9 00:00:20,130 --> 00:00:22,050 if it's going to be disclosed. 10 00:00:22,050 --> 00:00:24,120 The person that decides that level 11 00:00:24,120 --> 00:00:27,000 of data classification is the data owner. 12 00:00:27,000 --> 00:00:29,280 Now, what exactly would we consider 13 00:00:29,280 --> 00:00:31,680 sensitive data or information? 14 00:00:31,680 --> 00:00:35,670 Well, sensitive data is any information that can result 15 00:00:35,670 --> 00:00:39,420 in the loss of security or loss of advantage to a company, 16 00:00:39,420 --> 00:00:43,020 especially if it's accessed by unauthorized persons. 17 00:00:43,020 --> 00:00:43,980 Now, basically, 18 00:00:43,980 --> 00:00:46,800 this is the data that we need to be protecting. 19 00:00:46,800 --> 00:00:48,390 Anything that is sensitive, 20 00:00:48,390 --> 00:00:51,450 we want to make sure that there's protection around it, 21 00:00:51,450 --> 00:00:54,060 but we can protect everything equally, 22 00:00:54,060 --> 00:00:56,280 and that's why we have to classify data 23 00:00:56,280 --> 00:00:58,770 into several different categories, 24 00:00:58,770 --> 00:01:02,070 and those that are higher classification are going to need 25 00:01:02,070 --> 00:01:06,720 more protections and more resources spent against them. 26 00:01:06,720 --> 00:01:08,700 Those that are in lower categories, 27 00:01:08,700 --> 00:01:11,700 we're going to spend less on in terms of protection, 28 00:01:11,700 --> 00:01:13,890 time, and resources. 29 00:01:13,890 --> 00:01:16,710 Now, organizations need to be careful to establish 30 00:01:16,710 --> 00:01:20,970 proper policies to identify how data should be classified, 31 00:01:20,970 --> 00:01:22,740 because one of the trends I've seen a lot 32 00:01:22,740 --> 00:01:25,620 of people do is overclassifying data. 33 00:01:25,620 --> 00:01:27,750 If you are overclassifying your data, 34 00:01:27,750 --> 00:01:28,950 this is going to lead you 35 00:01:28,950 --> 00:01:32,460 to having to protect everything at a really high level, 36 00:01:32,460 --> 00:01:35,280 which means you are going to spend a lot more money, 37 00:01:35,280 --> 00:01:37,740 a lot more time, and a lot more resources 38 00:01:37,740 --> 00:01:39,300 to protect the data. 39 00:01:39,300 --> 00:01:41,760 This includes additional personnel, 40 00:01:41,760 --> 00:01:45,210 additional access controls, and other technical solutions 41 00:01:45,210 --> 00:01:48,120 that you are going to have to buy and deploy. 42 00:01:48,120 --> 00:01:50,730 So by classifying the data properly, 43 00:01:50,730 --> 00:01:54,450 it can then be separated into different levels of protection 44 00:01:54,450 --> 00:01:56,940 based on those classifications. 45 00:01:56,940 --> 00:01:59,010 There are two different classification schemes 46 00:01:59,010 --> 00:02:02,010 that are normally used by organizations, 47 00:02:02,010 --> 00:02:04,260 and the way you choose yours is based 48 00:02:04,260 --> 00:02:06,120 on whether you're a commercial business 49 00:02:06,120 --> 00:02:08,490 or a governmental organization. 50 00:02:08,490 --> 00:02:10,889 So if you're a commercial business like we are, 51 00:02:10,889 --> 00:02:12,090 you're going to use one 52 00:02:12,090 --> 00:02:14,640 of four common classification levels, 53 00:02:14,640 --> 00:02:16,590 and these go from lowest to highest 54 00:02:16,590 --> 00:02:20,520 as public, sensitive, private, and confidential. 55 00:02:20,520 --> 00:02:22,380 Public data would have no impact 56 00:02:22,380 --> 00:02:24,570 on your company if it's released, 57 00:02:24,570 --> 00:02:27,240 and usually this is information that is posted 58 00:02:27,240 --> 00:02:28,830 on an open source environment 59 00:02:28,830 --> 00:02:31,110 such as your website or other platforms. 60 00:02:31,110 --> 00:02:33,390 For example, this course is public data 61 00:02:33,390 --> 00:02:35,790 that is part of our organizational data. 62 00:02:35,790 --> 00:02:37,320 We've released it to the public. 63 00:02:37,320 --> 00:02:41,130 Anyone who pays for it can get access to the material. 64 00:02:41,130 --> 00:02:42,960 Then we have sensitive data. 65 00:02:42,960 --> 00:02:45,990 Sensitive data might have a minimal impact if released, 66 00:02:45,990 --> 00:02:49,110 such as your organization's financial data, or in my case, 67 00:02:49,110 --> 00:02:51,180 maybe the next course that I'm working on. 68 00:02:51,180 --> 00:02:52,620 I wouldn't want to get it out there 69 00:02:52,620 --> 00:02:53,820 before I release the course, 70 00:02:53,820 --> 00:02:56,250 because I don't want my competitors to see it 71 00:02:56,250 --> 00:02:58,140 and copy my material. 72 00:02:58,140 --> 00:02:59,963 Next, we have private data. 73 00:02:59,963 --> 00:03:02,040 Private data would contain things 74 00:03:02,040 --> 00:03:05,010 like personal records, salary information, 75 00:03:05,010 --> 00:03:09,090 any other data that is used only within the organization. 76 00:03:09,090 --> 00:03:12,240 For example, you don't need to know what the revenue is 77 00:03:12,240 --> 00:03:15,690 for our company, or how much our employees make, 78 00:03:15,690 --> 00:03:17,970 or what their social security numbers are. 79 00:03:17,970 --> 00:03:21,420 All of that is private data that we use internally, 80 00:03:21,420 --> 00:03:23,340 but none of our customers or anybody 81 00:03:23,340 --> 00:03:26,610 outside the organization needs to have access to it. 82 00:03:26,610 --> 00:03:28,980 Remember, private data is information 83 00:03:28,980 --> 00:03:31,800 that relates to an individual entity. 84 00:03:31,800 --> 00:03:34,140 Next, we have confidential data. 85 00:03:34,140 --> 00:03:37,350 This is going to contain items such as trade secrets, 86 00:03:37,350 --> 00:03:40,470 intellectual property or IP, source code, 87 00:03:40,470 --> 00:03:43,380 and other types of things that are seriously going to affect 88 00:03:43,380 --> 00:03:45,600 the business if disclosed. 89 00:03:45,600 --> 00:03:48,930 It can only be viewed by approved personnel, 90 00:03:48,930 --> 00:03:52,230 and possibly third parties under an NDA. 91 00:03:52,230 --> 00:03:53,670 So if you think about CompTIA, 92 00:03:53,670 --> 00:03:56,610 one of the things that's confidential is the test questions. 93 00:03:56,610 --> 00:03:58,860 They don't want all of those test questions running 94 00:03:58,860 --> 00:04:00,870 around the internet where you can download them, 95 00:04:00,870 --> 00:04:02,550 find the answers, and then go in 96 00:04:02,550 --> 00:04:05,850 and take the exams just by memorizing the test, right? 97 00:04:05,850 --> 00:04:07,350 That is against their policies, 98 00:04:07,350 --> 00:04:11,220 therefore, they protect the data as confidential data. 99 00:04:11,220 --> 00:04:13,110 Finally, we have critical data. 100 00:04:13,110 --> 00:04:14,700 This information is too valuable 101 00:04:14,700 --> 00:04:16,740 to allow any risk if it's captured. 102 00:04:16,740 --> 00:04:19,019 Viewing is severely restricted. 103 00:04:19,019 --> 00:04:21,000 This can be credit card numbers, for example, 104 00:04:21,000 --> 00:04:22,830 where access is severely limited 105 00:04:22,830 --> 00:04:25,050 to a few trusted individuals. 106 00:04:25,050 --> 00:04:27,780 Now, if you work in a military or government sector, 107 00:04:27,780 --> 00:04:30,690 you're going to have five different classification levels 108 00:04:30,690 --> 00:04:32,730 going from lowest to highest. 109 00:04:32,730 --> 00:04:36,330 These are probably what you hear inside movies all the time, 110 00:04:36,330 --> 00:04:39,660 things like unclassified, sensitive but classified, 111 00:04:39,660 --> 00:04:42,510 confidential, secret, top secret. 112 00:04:42,510 --> 00:04:45,000 The lowest classification is unclassified, 113 00:04:45,000 --> 00:04:47,550 and unclassified data generally can be released 114 00:04:47,550 --> 00:04:49,890 to the public, either just in general, 115 00:04:49,890 --> 00:04:52,410 or under the Freedom of Information Act. 116 00:04:52,410 --> 00:04:54,690 So there's actually a law in the United States 117 00:04:54,690 --> 00:04:56,940 that the public has a right to know information 118 00:04:56,940 --> 00:04:58,860 about their government, and if you submit 119 00:04:58,860 --> 00:05:00,887 a Freedom of Information Act request to one 120 00:05:00,887 --> 00:05:03,571 of the government organizations, they have to find 121 00:05:03,571 --> 00:05:07,290 all of the unclassified data that matches those terms 122 00:05:07,290 --> 00:05:10,530 that you've asked for, and then provide it back to you. 123 00:05:10,530 --> 00:05:12,420 The next category is called sensitive 124 00:05:12,420 --> 00:05:14,940 but unclassified data, and this includes things 125 00:05:14,940 --> 00:05:17,340 like medical records, personal files, 126 00:05:17,340 --> 00:05:20,130 and other items that won't hurt national security 127 00:05:20,130 --> 00:05:22,590 if released, but would impact those 128 00:05:22,590 --> 00:05:24,840 whose data is being used inside of it. 129 00:05:24,840 --> 00:05:26,880 So for example, if you look at the military, 130 00:05:26,880 --> 00:05:29,910 they have a lot of soldiers, sailors, and airmen. 131 00:05:29,910 --> 00:05:31,740 If I took one of their medical records 132 00:05:31,740 --> 00:05:34,590 that has their birthday, their social security number, 133 00:05:34,590 --> 00:05:36,360 and medical information about them, 134 00:05:36,360 --> 00:05:39,000 that would be considered sensitive but unclassified. 135 00:05:39,000 --> 00:05:41,940 If it gets out that private Timmy had a strep infection 136 00:05:41,940 --> 00:05:44,550 last week, that would affect Timmy maybe, 137 00:05:44,550 --> 00:05:47,430 but it's not going to affect the military at large. 138 00:05:47,430 --> 00:05:49,350 The next one we have is confidential. 139 00:05:49,350 --> 00:05:52,080 Confidential data includes data such as trade secrets, 140 00:05:52,080 --> 00:05:54,720 other information that can seriously affect the government 141 00:05:54,720 --> 00:05:57,171 if unauthorized disclosure were to happen 142 00:05:57,171 --> 00:06:00,090 Then we get into secret data, 143 00:06:00,090 --> 00:06:01,890 and secret data is going to include things 144 00:06:01,890 --> 00:06:05,010 like military deployment plans, defensive postures, 145 00:06:05,010 --> 00:06:07,380 and other information that could seriously damage 146 00:06:07,380 --> 00:06:10,260 national security if disclosure was to happen. 147 00:06:10,260 --> 00:06:12,445 Now, when I talked about confidential data, 148 00:06:12,445 --> 00:06:14,430 it would seriously affect us. 149 00:06:14,430 --> 00:06:16,290 Now, if I talk about secret data, 150 00:06:16,290 --> 00:06:18,690 it could seriously damage us. 151 00:06:18,690 --> 00:06:20,730 Finally, we have the highest classification, 152 00:06:20,730 --> 00:06:22,620 which is known as top secret. 153 00:06:22,620 --> 00:06:24,720 Top secret data might include the blueprints 154 00:06:24,720 --> 00:06:26,970 for a weapon system or other information 155 00:06:26,970 --> 00:06:28,765 that would gravely damage national security 156 00:06:28,765 --> 00:06:31,608 if it was known to those who were not authorized 157 00:06:31,608 --> 00:06:34,350 for this level of information. 158 00:06:34,350 --> 00:06:35,550 So you can see 159 00:06:35,550 --> 00:06:38,550 that these classifications get more and more serious, 160 00:06:38,550 --> 00:06:41,250 and they would have bigger and bigger effects to us, 161 00:06:41,250 --> 00:06:44,640 and so we're willing to spend more money and more time 162 00:06:44,640 --> 00:06:48,030 to protect the higher levels of classification. 163 00:06:48,030 --> 00:06:50,160 Protecting data takes up a lot of resources, 164 00:06:50,160 --> 00:06:52,110 as I've already mentioned, and therefore, 165 00:06:52,110 --> 00:06:55,110 it's really important for you to understand the lifecycle 166 00:06:55,110 --> 00:06:57,660 of the data as you collect it, retain it, 167 00:06:57,660 --> 00:06:59,880 and eventually dispose of it. 168 00:06:59,880 --> 00:07:01,890 Now, what I mean by that is that 169 00:07:01,890 --> 00:07:04,110 data should not be stored forever. 170 00:07:04,110 --> 00:07:06,248 Your organization needs to have policies 171 00:07:06,248 --> 00:07:09,930 that are going to dictate how the data is being stored, 172 00:07:09,930 --> 00:07:11,670 when the data is going to be stored, 173 00:07:11,670 --> 00:07:15,270 and for how long it is going to be stored, and then finally, 174 00:07:15,270 --> 00:07:18,210 how are you going to destroy it when you are done with it. 175 00:07:18,210 --> 00:07:20,670 For example, let's say I was going to have a course 176 00:07:20,670 --> 00:07:23,010 that's going to happen next week, and you sign up 177 00:07:23,010 --> 00:07:25,590 to attend the course, and you give me your information 178 00:07:25,590 --> 00:07:27,600 like your credit card number, your name, 179 00:07:27,600 --> 00:07:30,030 your address, your email, things like that. 180 00:07:30,030 --> 00:07:32,220 How should I keep that in my system? 181 00:07:32,220 --> 00:07:34,410 Should I keep it just until you come and show up 182 00:07:34,410 --> 00:07:37,020 for the course, or should I keep it for the next six months, 183 00:07:37,020 --> 00:07:38,970 maybe a year, maybe five years, 184 00:07:38,970 --> 00:07:41,460 maybe 20 years, maybe forever? 185 00:07:41,460 --> 00:07:44,544 Well, that's going to depend on the organizational needs. 186 00:07:44,544 --> 00:07:47,520 All of this should be defined in your policies, 187 00:07:47,520 --> 00:07:49,380 and they should clearly be documenting 188 00:07:49,380 --> 00:07:51,930 what your organizational needs are, 189 00:07:51,930 --> 00:07:53,490 how long you need to keep this data, 190 00:07:53,490 --> 00:07:56,384 and what the lifecycle is going to look like. 191 00:07:56,384 --> 00:07:58,680 Also, you need to ensure that you're following 192 00:07:58,680 --> 00:08:01,050 the local, state, and government laws 193 00:08:01,050 --> 00:08:04,200 and regulations for data retention time requirements, 194 00:08:04,200 --> 00:08:06,630 because depending on the type of organization you are, 195 00:08:06,630 --> 00:08:09,330 you may have legal requirements that may say 196 00:08:09,330 --> 00:08:11,850 that you need to contain certain types of data 197 00:08:11,850 --> 00:08:13,323 for certain periods of time.