In this lesson, we are going to talk
a bit more in depth about the concept
of data classifications.
We are going to formally define them
to ensure that you're ready for any questions you get
about data classifications on the exam.
Data classification is based on the value
to the organization and the sensitivity of the information
if it's going to be disclosed.
The person that decides that level
of data classification is the data owner.
Now, what exactly would we consider
sensitive data or information?
Well, sensitive data is any information that can result
in the loss of security or loss of advantage to a company,
especially if it's accessed by unauthorized persons.
Now, basically,
this is the data that we need to be protecting.
Anything that is sensitive,
we want to make sure that there's protection around it,
but we can protect everything equally,
and that's why we have to classify data
into several different categories,
and those that are higher classification are going to need
more protections and more resources spent against them.
Those that are in lower categories,
we're going to spend less on in terms of protection,
time, and resources.
Now, organizations need to be careful to establish
proper policies to identify how data should be classified,
because one of the trends I've seen a lot
of people do is overclassifying data.
If you are overclassifying your data,
this is going to lead you
to having to protect everything at a really high level,
which means you are going to spend a lot more money,
a lot more time, and a lot more resources
to protect the data.
This includes additional personnel,
additional access controls, and other technical solutions
that you are going to have to buy and deploy.
So by classifying the data properly,
it can then be separated into different levels of protection
based on those classifications.
There are two different classification schemes
that are normally used by organizations,
and the way you choose yours is based
on whether you're a commercial business
or a governmental organization.
So if you're a commercial business like we are,
you're going to use one
of four common classification levels,
and these go from lowest to highest
as public, sensitive, private, and confidential.
Public data would have no impact
on your company if it's released,
and usually this is information that is posted
on an open source environment
such as your website or other platforms.
For example, this course is public data
that is part of our organizational data.
We've released it to the public.
Anyone who pays for it can get access to the material.
Then we have sensitive data.
Sensitive data might have a minimal impact if released,
such as your organization's financial data, or in my case,
maybe the next course that I'm working on.
I wouldn't want to get it out there
before I release the course,
because I don't want my competitors to see it
and copy my material.
Next, we have private data.
Private data would contain things
like personal records, salary information,
any other data that is used only within the organization.
For example, you don't need to know what the revenue is
for our company, or how much our employees make,
or what their social security numbers are.
All of that is private data that we use internally,
but none of our customers or anybody
outside the organization needs to have access to it.
Remember, private data is information
that relates to an individual entity.
Next, we have confidential data.
This is going to contain items such as trade secrets,
intellectual property or IP, source code,
and other types of things that are seriously going to affect
the business if disclosed.
It can only be viewed by approved personnel,
and possibly third parties under an NDA.
So if you think about CompTIA,
one of the things that's confidential is the test questions.
They don't want all of those test questions running
around the internet where you can download them,
find the answers, and then go in
and take the exams just by memorizing the test, right?
That is against their policies,
therefore, they protect the data as confidential data.
Finally, we have critical data.
This information is too valuable
to allow any risk if it's captured.
Viewing is severely restricted.
This can be credit card numbers, for example,
where access is severely limited
to a few trusted individuals.
Now, if you work in a military or government sector,
you're going to have five different classification levels
going from lowest to highest.
These are probably what you hear inside movies all the time,
things like unclassified, sensitive but classified,
confidential, secret, top secret.
The lowest classification is unclassified,
and unclassified data generally can be released
to the public, either just in general,
or under the Freedom of Information Act.
So there's actually a law in the United States
that the public has a right to know information
about their government, and if you submit
a Freedom of Information Act request to one
of the government organizations, they have to find
all of the unclassified data that matches those terms
that you've asked for, and then provide it back to you.
The next category is called sensitive
but unclassified data, and this includes things
like medical records, personal files,
and other items that won't hurt national security
if released, but would impact those
whose data is being used inside of it.
So for example, if you look at the military,
they have a lot of soldiers, sailors, and airmen.
If I took one of their medical records
that has their birthday, their social security number,
and medical information about them,
that would be considered sensitive but unclassified.
If it gets out that private Timmy had a strep infection
last week, that would affect Timmy maybe,
but it's not going to affect the military at large.
The next one we have is confidential.
Confidential data includes data such as trade secrets,
other information that can seriously affect the government
if unauthorized disclosure were to happen
Then we get into secret data,
and secret data is going to include things
like military deployment plans, defensive postures,
and other information that could seriously damage
national security if disclosure was to happen.
Now, when I talked about confidential data,
it would seriously affect us.
Now, if I talk about secret data,
it could seriously damage us.
Finally, we have the highest classification,
which is known as top secret.
Top secret data might include the blueprints
for a weapon system or other information
that would gravely damage national security
if it was known to those who were not authorized
for this level of information.
So you can see
that these classifications get more and more serious,
and they would have bigger and bigger effects to us,
and so we're willing to spend more money and more time
to protect the higher levels of classification.
Protecting data takes up a lot of resources,
as I've already mentioned, and therefore,
it's really important for you to understand the lifecycle
of the data as you collect it, retain it,
and eventually dispose of it.
Now, what I mean by that is that
data should not be stored forever.
Your organization needs to have policies
that are going to dictate how the data is being stored,
when the data is going to be stored,
and for how long it is going to be stored, and then finally,
how are you going to destroy it when you are done with it.
For example, let's say I was going to have a course
that's going to happen next week, and you sign up
to attend the course, and you give me your information
like your credit card number, your name,
your address, your email, things like that.
How should I keep that in my system?
Should I keep it just until you come and show up
for the course, or should I keep it for the next six months,
maybe a year, maybe five years,
maybe 20 years, maybe forever?
Well, that's going to depend on the organizational needs.
All of this should be defined in your policies,
and they should clearly be documenting
what your organizational needs are,
how long you need to keep this data,
and what the lifecycle is going to look like.
Also, you need to ensure that you're following
the local, state, and government laws
and regulations for data retention time requirements,
because depending on the type of organization you are,
you may have legal requirements that may say
that you need to contain certain types of data
for certain periods of time.