1
00:00:06,480 --> 00:00:11,190
- In 12.2, we're gonna talk
about data classification.

2
00:00:11,190 --> 00:00:14,110
Classification is the
process of organizing assets

3
00:00:14,110 --> 00:00:18,690
by either criticality or by sensitivity.

4
00:00:18,690 --> 00:00:20,160
The sensitivity is based

5
00:00:20,160 --> 00:00:22,740
on the impact of the assets exposure.

6
00:00:22,740 --> 00:00:25,830
So if this asset was exposed to the public

7
00:00:25,830 --> 00:00:27,930
or maybe just internally
to the organization

8
00:00:27,930 --> 00:00:31,200
or to a competitor, right
what would be the impact?

9
00:00:31,200 --> 00:00:32,940
That's sensitivity.

10
00:00:32,940 --> 00:00:36,810
Criticality is based on the
impact of the assets loss.

11
00:00:36,810 --> 00:00:38,910
So operational criticality, right?

12
00:00:38,910 --> 00:00:41,760
If this system wasn't available to us

13
00:00:41,760 --> 00:00:43,110
what would be the impact?

14
00:00:43,110 --> 00:00:44,880
And this criteria is often used

15
00:00:44,880 --> 00:00:48,330
in disaster recovery and
business continuity planning.

16
00:00:48,330 --> 00:00:51,414
Asset classifications inform
risk management decisions,

17
00:00:51,414 --> 00:00:55,950
protection strategies,
control decisions, audit scope

18
00:00:55,950 --> 00:00:58,530
and regulatory compliance activities.

19
00:00:58,530 --> 00:01:01,320
I can't stress enough how important going

20
00:01:01,320 --> 00:01:03,750
through the classification process is

21
00:01:03,750 --> 00:01:07,983
and accurately classifying
all of our assets.

22
00:01:10,080 --> 00:01:11,640
So let's look a little deeper into some

23
00:01:11,640 --> 00:01:14,250
of the classification
benefits in terms of security,

24
00:01:14,250 --> 00:01:19,050
compliance, prioritization
and cost efficiency.

25
00:01:19,050 --> 00:01:21,960
By categorizing data,
organizations can apply

26
00:01:21,960 --> 00:01:25,020
the appropriate security
measures such as encryption,

27
00:01:25,020 --> 00:01:27,003
access control and monitoring.

28
00:01:28,230 --> 00:01:31,016
Classifications can help
organizations ensure,

29
00:01:31,016 --> 00:01:33,330
right that regulations are being followed

30
00:01:33,330 --> 00:01:37,470
by identifying which data falls
under that particular domain

31
00:01:37,470 --> 00:01:40,331
and applying the necessary controls.

32
00:01:40,331 --> 00:01:43,170
And for prioritization,

33
00:01:43,170 --> 00:01:46,920
classification can help
organizations prioritize data

34
00:01:46,920 --> 00:01:50,910
for backup, for retention
and for disaster recovery.

35
00:01:50,910 --> 00:01:53,220
And then there's cost efficiency.

36
00:01:53,220 --> 00:01:55,470
Classifications can help organizations

37
00:01:55,470 --> 00:01:59,790
make informed decisions about
where to allocate resources

38
00:01:59,790 --> 00:02:02,010
and invest in security measures.

39
00:02:02,010 --> 00:02:03,510
Hopefully now you're convinced

40
00:02:03,510 --> 00:02:06,810
that classification is a
really important thing to do

41
00:02:06,810 --> 00:02:09,813
with a myriad of benefits
for an organization.

42
00:02:12,120 --> 00:02:15,750
The classification designs vary by sector.

43
00:02:15,750 --> 00:02:18,330
The number of and the
type of classifications

44
00:02:18,330 --> 00:02:20,520
in the private sector are discretionary.

45
00:02:20,520 --> 00:02:23,250
Now by discretionary, I
don't mean you can do it

46
00:02:23,250 --> 00:02:24,150
or you don't have to do it.

47
00:02:24,150 --> 00:02:27,540
I just mean how many of
types of classifications,

48
00:02:27,540 --> 00:02:29,760
a number of classifications
and what they're called

49
00:02:29,760 --> 00:02:31,440
are going to be discretionary.

50
00:02:31,440 --> 00:02:34,260
Now, many companies will
maybe do three levels,

51
00:02:34,260 --> 00:02:36,690
some will do four levels, right?

52
00:02:36,690 --> 00:02:41,690
They may be public, internal
use only, confidential

53
00:02:42,150 --> 00:02:44,970
and then protected or whatever it is

54
00:02:44,970 --> 00:02:47,310
that you wanna use in your
organization to describe them.

55
00:02:47,310 --> 00:02:48,840
But whatever you're doing,

56
00:02:48,840 --> 00:02:51,090
those classification
levels should be defined

57
00:02:51,090 --> 00:02:53,910
in policy and supported by standards.

58
00:02:53,910 --> 00:02:56,100
And in our last module, module five

59
00:02:56,100 --> 00:02:58,320
we'll talk a lot about
those governance documents

60
00:02:58,320 --> 00:03:00,660
about policies and standards.

61
00:03:00,660 --> 00:03:04,380
Now generally, in government,
in military agencies

62
00:03:04,380 --> 00:03:07,860
in national security
institutions, the number

63
00:03:07,860 --> 00:03:11,400
and type of classifications
you're gonna have are mandated.

64
00:03:11,400 --> 00:03:14,310
And those classification
labels are assigned

65
00:03:14,310 --> 00:03:19,140
by classification officers
based on predefined criteria.

66
00:03:19,140 --> 00:03:21,810
So we have these mandated
classification levels, right

67
00:03:21,810 --> 00:03:24,240
in government, national security

68
00:03:24,240 --> 00:03:26,280
and military agencies and institutions

69
00:03:26,280 --> 00:03:29,553
and we have discretionary
in the private sector.

70
00:03:31,890 --> 00:03:32,723
Let me give you an example

71
00:03:32,723 --> 00:03:35,730
of some national security classifications.

72
00:03:35,730 --> 00:03:36,990
We may start at the lowest level

73
00:03:36,990 --> 00:03:39,630
which is unclassified,
information doesn't need

74
00:03:39,630 --> 00:03:42,570
to be protected and may
be released to the public.

75
00:03:42,570 --> 00:03:45,360
Then we have controlled
unclassified information,

76
00:03:45,360 --> 00:03:47,790
which it's information
that needs to be protected

77
00:03:47,790 --> 00:03:51,063
and does require strict
controls over its distribution.

78
00:03:51,960 --> 00:03:53,820
Then we might have confidential, right

79
00:03:53,820 --> 00:03:57,406
or disclosure expected to cause
damage to national security.

80
00:03:57,406 --> 00:04:00,660
And we might have secret,
which is disclosure expected

81
00:04:00,660 --> 00:04:03,480
to cause serious damage
to national security.

82
00:04:03,480 --> 00:04:06,018
And then top secret disclosure expected

83
00:04:06,018 --> 00:04:10,020
to cause exceptionally grave
danger to national security.

84
00:04:10,020 --> 00:04:14,340
Now, all of these right,
are based on the sensitivity

85
00:04:14,340 --> 00:04:17,763
of the data, what would happen
if that data was exposed.

86
00:04:20,730 --> 00:04:23,481
A security clearance is a
determination that is made

87
00:04:23,481 --> 00:04:26,630
by the government or by
military that an individual

88
00:04:26,630 --> 00:04:30,390
is eligible to access
classified information up

89
00:04:30,390 --> 00:04:32,610
to a certain level of classification.

90
00:04:32,610 --> 00:04:35,640
So it's only where we have
these mandatory classifications

91
00:04:35,640 --> 00:04:36,840
that we're also going to have what's known

92
00:04:36,840 --> 00:04:37,860
as security clearance.

93
00:04:37,860 --> 00:04:39,570
So we classify the data,

94
00:04:39,570 --> 00:04:42,519
but we apply security
clearance to individuals.

95
00:04:42,519 --> 00:04:47,519
Now, I'm bringing it up
here because it really ties

96
00:04:48,300 --> 00:04:49,530
into data classifications

97
00:04:49,530 --> 00:04:53,760
because clearance levels
mirror data classification.

98
00:04:53,760 --> 00:04:55,320
So you may have a clearance level

99
00:04:55,320 --> 00:04:58,263
of top secret or secret or confidential.

100
00:04:58,263 --> 00:05:00,030
Now, clearance is gonna be valid

101
00:05:00,030 --> 00:05:03,259
for a specific amount of time
and then must be renewed.

102
00:05:03,259 --> 00:05:05,820
And clearance officers are responsible

103
00:05:05,820 --> 00:05:07,170
for the clearance process.

104
00:05:07,170 --> 00:05:08,520
There's a lot of background checking

105
00:05:08,520 --> 00:05:10,020
and vetting that goes on.

106
00:05:10,020 --> 00:05:12,300
I also wanna make sure that, I
don't give you the impression

107
00:05:12,300 --> 00:05:14,880
that just because you
have a clearance level

108
00:05:14,880 --> 00:05:18,120
you can get to all data that's
classified at that level.

109
00:05:18,120 --> 00:05:21,390
You also have to have a
bonafide need to know.

110
00:05:21,390 --> 00:05:23,280
And when we talk about access controls

111
00:05:23,280 --> 00:05:24,240
a little bit later on,

112
00:05:24,240 --> 00:05:26,220
we'll circle back to
talking about clearance.

113
00:05:26,220 --> 00:05:28,260
But I just wanted to introduce it here

114
00:05:28,260 --> 00:05:31,650
because it does directly tie into talking

115
00:05:31,650 --> 00:05:32,973
about classifications.

116
00:05:34,530 --> 00:05:36,600
As I mentioned earlier,
in the private sector

117
00:05:36,600 --> 00:05:38,580
it's really discretionary how many levels

118
00:05:38,580 --> 00:05:41,847
and types of classifications
an organization wants to have.

119
00:05:41,847 --> 00:05:45,060
But deciding upon the criticality

120
00:05:45,060 --> 00:05:48,780
and the sensitivity
classification categories

121
00:05:48,780 --> 00:05:51,030
the definitions and the number of levels

122
00:05:51,030 --> 00:05:53,790
is really a management function.

123
00:05:53,790 --> 00:05:56,944
Now, classification categories
should be codified in policy.

124
00:05:56,944 --> 00:05:59,100
Our handling and protection standards

125
00:05:59,100 --> 00:06:01,590
should be developed
for each classification

126
00:06:01,590 --> 00:06:03,420
and classification categories

127
00:06:03,420 --> 00:06:06,900
and corresponding handling
standards should be communicated

128
00:06:06,900 --> 00:06:08,850
throughout the organization.

129
00:06:08,850 --> 00:06:10,860
So let me give you an illustration

130
00:06:10,860 --> 00:06:12,753
of a private sector classification.

131
00:06:13,680 --> 00:06:14,700
We might have public

132
00:06:14,700 --> 00:06:16,890
you say information that
is for public consumption

133
00:06:16,890 --> 00:06:18,660
for example a press release.

134
00:06:18,660 --> 00:06:21,180
We may have internal use
only, the information

135
00:06:21,180 --> 00:06:23,730
that's widely available
within the organization,

136
00:06:23,730 --> 00:06:25,950
but not to be shared
outside the organization.

137
00:06:25,950 --> 00:06:27,973
So for example, an an ORG chart.

138
00:06:27,973 --> 00:06:30,090
We might have confidential,

139
00:06:30,090 --> 00:06:33,000
which is information that
is sensitive or proprietary.

140
00:06:33,000 --> 00:06:35,280
So for example, a trade secret.

141
00:06:35,280 --> 00:06:37,920
And then we might have
protected, which is information

142
00:06:37,920 --> 00:06:41,430
that's governed by regulation
or other obligations

143
00:06:41,430 --> 00:06:44,760
like consumer financial
account information.

144
00:06:44,760 --> 00:06:48,690
So public, internal use only,
confidential and protected.

145
00:06:48,690 --> 00:06:51,690
It's up to each private sector
organization to determine

146
00:06:51,690 --> 00:06:54,450
what they wanna have, but
this is a pretty common

147
00:06:54,450 --> 00:06:58,653
or standard using four levels
and defining them this way.

148
00:07:00,075 --> 00:07:03,570
Now, it's really important
that we communicate

149
00:07:03,570 --> 00:07:06,780
to our user community as
well as our custodians

150
00:07:06,780 --> 00:07:10,170
those who are managing and
monitoring, right the data

151
00:07:10,170 --> 00:07:12,750
as well as anyone else that
we might be sharing that data

152
00:07:12,750 --> 00:07:16,470
with, right what the
classification level is

153
00:07:16,470 --> 00:07:19,500
and the way we accomplish
that is by labeling.

154
00:07:19,500 --> 00:07:21,540
Labeling is the vehicle for communicating

155
00:07:21,540 --> 00:07:24,480
the assigned classification to custodians,

156
00:07:24,480 --> 00:07:27,450
users and applications.

157
00:07:27,450 --> 00:07:29,220
Now labels can take lots of forms.

158
00:07:29,220 --> 00:07:31,050
They can be electronic, they can be print,

159
00:07:31,050 --> 00:07:33,420
they can be audio, they could be visual.

160
00:07:33,420 --> 00:07:36,210
They should always be appropriate
for the intended audience.

161
00:07:36,210 --> 00:07:38,250
So we wanna have them
in the correct language

162
00:07:38,250 --> 00:07:40,680
and in a way that they can
easily be read and understood.

163
00:07:40,680 --> 00:07:42,750
And labels are really important

164
00:07:42,750 --> 00:07:45,750
because they transcend
institutional knowledge.

165
00:07:45,750 --> 00:07:47,670
So it's not like, oh yeah I
should know that's confidential

166
00:07:47,670 --> 00:07:49,320
or I should know that's top secret.

167
00:07:49,320 --> 00:07:51,600
When it's labeled, we know what it is.

168
00:07:51,600 --> 00:07:54,480
So it provides stability and continuity.

169
00:07:54,480 --> 00:07:57,390
And those visual labels, right the visual,

170
00:07:57,390 --> 00:08:01,110
I mean you can see them
labels communicate to everyone

171
00:08:01,110 --> 00:08:04,350
who might come in contact
with that data, right

172
00:08:04,350 --> 00:08:06,240
what the classification level is

173
00:08:06,240 --> 00:08:09,810
and then what all the
corresponding standards are

174
00:08:09,810 --> 00:08:12,663
for how we're going to protect that data.

175
00:08:14,956 --> 00:08:17,490
So what do we really mean
by handling standards?

176
00:08:17,490 --> 00:08:19,407
Handling standards inform custodians

177
00:08:19,407 --> 00:08:22,470
and users how to protect the
information that they use

178
00:08:22,470 --> 00:08:25,260
and the systems that they interact with.

179
00:08:25,260 --> 00:08:29,100
Now handling standards dictate
by classification level

180
00:08:29,100 --> 00:08:31,590
how information must
be stored, transmitted,

181
00:08:31,590 --> 00:08:35,190
communicated, access,
retained and destroyed.

182
00:08:35,190 --> 00:08:38,370
Our handling standards aren't
just for people, right?

183
00:08:38,370 --> 00:08:41,550
They also extend to automated
tools such as our DLP

184
00:08:41,550 --> 00:08:43,126
our data loss prevention solutions

185
00:08:43,126 --> 00:08:46,980
and handling standards may
also extend all the way

186
00:08:46,980 --> 00:08:50,613
out to our incident management
and our breach notification.

187
00:08:51,676 --> 00:08:53,460
Well, that my friends, brings us

188
00:08:53,460 --> 00:08:55,020
to a three-second challenge.

189
00:08:55,020 --> 00:08:56,880
Five challenge questions,
three-seconds each.

190
00:08:56,880 --> 00:08:57,713
Let's do it.

191
00:08:59,820 --> 00:09:01,650
This type of classification is based

192
00:09:01,650 --> 00:09:04,040
on the impact of asset loss.

193
00:09:04,040 --> 00:09:06,603
One, two, three.

194
00:09:08,550 --> 00:09:09,850
It's gonna be criticality.

195
00:09:11,070 --> 00:09:13,470
Number two, this type of
classification is based

196
00:09:13,470 --> 00:09:16,530
on the impact of asset exposure.

197
00:09:16,530 --> 00:09:18,123
One, two, three.

198
00:09:19,110 --> 00:09:20,493
It's gonna be sensitivity.

199
00:09:21,780 --> 00:09:24,750
Number three, national
security classification applied

200
00:09:24,750 --> 00:09:26,160
when disclosure's expected

201
00:09:26,160 --> 00:09:29,493
to cause exceptionally grave
danger to national security.

202
00:09:30,627 --> 00:09:33,990
One, two, three.

203
00:09:33,990 --> 00:09:35,313
That would be top secret.

204
00:09:36,570 --> 00:09:39,600
Number four, determination
made by the government

205
00:09:39,600 --> 00:09:41,070
that an individual is eligible

206
00:09:41,070 --> 00:09:43,620
to access classified information up

207
00:09:43,620 --> 00:09:45,470
to a certain level of classification.

208
00:09:46,740 --> 00:09:48,873
One, two, three.

209
00:09:50,070 --> 00:09:51,393
That's gonna be clearance.

210
00:09:52,710 --> 00:09:55,890
And lastly, number five
this is for communicating

211
00:09:55,890 --> 00:09:58,560
the assigned classification to custodians,

212
00:09:58,560 --> 00:10:01,023
users and applications.

213
00:10:02,070 --> 00:10:03,753
One, two, three.

214
00:10:05,070 --> 00:10:06,030
And this is labeling.

215
00:10:06,030 --> 00:10:08,890
And labeling really is
very, very important

216
00:10:11,490 --> 00:10:13,590
Right, that brings us
to a security-in-action.

217
00:10:13,590 --> 00:10:15,450
So we can practically apply our knowledge.

218
00:10:15,450 --> 00:10:17,763
And this one's about classification.

219
00:10:18,930 --> 00:10:22,740
You work for a relatively
small, privately owned company.

220
00:10:22,740 --> 00:10:25,650
The company's expanding
both in markets served

221
00:10:25,650 --> 00:10:27,630
and geographically.

222
00:10:27,630 --> 00:10:30,030
You're preparing a
presentation for management

223
00:10:30,030 --> 00:10:33,870
on why classification
is integral to growth.

224
00:10:33,870 --> 00:10:35,850
So what are you gonna tell them?

225
00:10:35,850 --> 00:10:36,683
So this is interesting.

226
00:10:36,683 --> 00:10:38,340
It's a small company, right?

227
00:10:38,340 --> 00:10:39,510
So you're a small company,

228
00:10:39,510 --> 00:10:42,030
probably have no classification
system it sounds like.

229
00:10:42,030 --> 00:10:43,650
Privately held, right?

230
00:10:43,650 --> 00:10:44,610
So privately owned.

231
00:10:44,610 --> 00:10:46,440
So it's not government, it's not military

232
00:10:46,440 --> 00:10:47,853
it's not national security.

233
00:10:48,720 --> 00:10:51,780
They are expanding both
in the markets they serve

234
00:10:51,780 --> 00:10:53,760
and the geographies.

235
00:10:53,760 --> 00:10:57,240
So they're expanding market
served and geographies.

236
00:10:57,240 --> 00:11:00,944
And you need to convince
management that why

237
00:11:00,944 --> 00:11:05,944
we need to stop, step back
and classify our data perhaps

238
00:11:06,750 --> 00:11:10,079
in our systems before moving on.

239
00:11:10,079 --> 00:11:13,620
And you wanna explain to them
why it's gonna be so important

240
00:11:13,620 --> 00:11:15,570
and so helpful to our growth.

241
00:11:15,570 --> 00:11:16,800
So what are you gonna tell them?

242
00:11:16,800 --> 00:11:18,270
Put me on pause, think about it,

243
00:11:18,270 --> 00:11:20,133
write down some notes, come on back.

244
00:11:21,750 --> 00:11:24,300
So here might be your
presentation highlights

245
00:11:24,300 --> 00:11:26,370
that there's a wide range
of benefits from having

246
00:11:26,370 --> 00:11:30,000
a comprehensive well-planned
classification program,

247
00:11:30,000 --> 00:11:32,940
including it'll inform our
risk management decisions,

248
00:11:32,940 --> 00:11:37,110
our protection strategies
and our control decisions.

249
00:11:37,110 --> 00:11:39,300
It'll communicate our resource

250
00:11:39,300 --> 00:11:41,343
and our protection priorities.

251
00:11:42,270 --> 00:11:47,190
It will support regulatory
compliance and it will add value

252
00:11:47,190 --> 00:11:51,150
by allocating resources
efficiently to help us make

253
00:11:51,150 --> 00:11:53,880
the right decision and
allow us to communicate

254
00:11:53,880 --> 00:11:56,767
those protection strategies
to our communities.

255
00:11:56,767 --> 00:12:00,150
Make sure that we're staying
right in regulatory compliance,

256
00:12:00,150 --> 00:12:05,150
that we're not in non-compliance
which could result in fines

257
00:12:05,370 --> 00:12:10,370
or loss of a license or in
worse case, a jail time.

258
00:12:11,100 --> 00:12:14,280
And we're gonna add value
because we'll be allocating

259
00:12:14,280 --> 00:12:17,790
our protection resources very efficiently.

260
00:12:17,790 --> 00:12:19,440
That's what I would put
in the presentation.

261
00:12:19,440 --> 00:12:21,630
I bet that's what you put too.

262
00:12:21,630 --> 00:12:24,120
Right, all of that is, oh, you know,

263
00:12:24,120 --> 00:12:25,478
it's security-in-action.

264
00:12:25,478 --> 00:12:28,740
It's a relatively small Word Cloud

265
00:12:28,740 --> 00:12:30,570
but it's a really important Word Cloud.

266
00:12:30,570 --> 00:12:32,070
So make sure again, you can speak

267
00:12:32,070 --> 00:12:35,514
to all of these terms and
concepts before you move on.

268
00:12:35,514 --> 00:12:38,033
When you're ready, I'll
see you in the next lesson.