In this lesson,
we will learn about data classification.
Data classification is the process of organizing data
into categories based on its sensitivity, value,
or in response to regulatory requirements.
A data classification determines the level
of security controls and handling procedures
that will be applied to it.
Data classification models are frameworks
or methodologies used to categorize data
into levels or types based on sensitivity.
Classification models used categories such as public,
internal, confidential, or restricted.
Each level dictates the security measures required
to protect that level of data.
Data classification occurs during the data creation stage
of the data lifecycle,
and is the process of a applying confidentiality
and privacy labels to a given piece of information.
I personally find that the best way to think about this
is if you think of any kind of military movie
or spy movie that you might have watched in the past.
In a movie, somebody might have a folder,
and on the outside of that folder
you might see a label such as top secret.
This classification level
indicates the contents of that folder
contain top secret information,
and therefore it needs to be protected
using certain types of controls
to keep it safe from prying eyes.
Now, within our networks, the same thing happens,
but our networks use electronic mechanisms
to classify and label data.
Different classification models can be used to do this
depending on the type of network
and the way in which the network is organized.
The most common model used
is the government or military classification model.
It utilizes the classification labels
of unclassified, confidential, secret,
and top secret.
The unclassified label
indicates that there are no restrictions
on viewing that data,
and it presents no risk to our organization
if the information is disclosed.
For example, many army field manuals
are categorized as unclassified information.
This means that anyone can go to the website, download it,
and read and learn about how the army does its business.
The lowest level of classified and protected data
in the military model is confidential classification.
Confidential data should only be viewed
by authorized people within the organization,
or possibly those who are trusted under an NDA,
or non-disclosure agreement.
For example, the position of a navy ship in the ocean
may be classified as confidential,
meaning only certain people can be told
where that ship located.
The next level of classified data is secret.
Secret information or data is valuable.
The restrictions on this data are stricter
than for confidential data.
In the U.S. military, for example,
secret information can only be viewed
by people who are authorized to view it,
and they can only view it in certain buildings
or by using a specific network
known as the Secret Internet Protocol Router Network,
or SIPRNet.
SIPRNet is used to view, process,
and store secret information,
and it's not even connected to the regular internet.
This is because the internet
is considered to be unclassified and untrusted,
and we don't want secret data to get onto the internet.
Therefore, the secret network has more protections in place,
such as higher levels of encryption.
And while it costs more to build
and operate the secret networks,
the data being stored on them is very valuable,
so it's worth spending that additional money to protect it.
The highest level of security
in the government or military model is known as top secret.
If top secret information or data is disclosed,
it would cause grave danger
or have grave consequences to the organization.
Again, let's consider the military
and see how different types of information might be used.
Let's imagine we work for a top secret military organization
that's responsible for finding a malicious hacker
located somewhere in the world.
The sources and methods used to find that hacker
would likely be considered top secret.
If hackers knew about the sources or methods being used,
it would be easier for them to evade detection.
This would allow a hacker
to continue attacking military systems,
which poses a grave danger to the military
and to the country.
But once we find out where that hacker is,
we need to get the location to soldiers
who can go and capture them.
At this point,
the soldiers have a need to know where the hacker is,
but they don't necessarily need to know
the sources and methods that were used to find that hacker.
So while the sources and methods
used to find the hacker might remain top secret,
the hacker's actual GPS location
may only be classified as secret.
This lower classification level
allows us to give the location to the soldiers
who are going to go and perform the mission.
So different pieces of information
can be protected in different ways and at different times.
Usually, in the government or military system,
there will be separate networks for classification levels.
So it's typical for people
to have multiple computers at their desk,
one for each level of classification they need access to.
They might have one for unclassified things,
like email and searching the internet,
a second one for working on secret data,
and a third one for working on top secret data.
This provides physical separation
among the three data classifications
and allows each network to be protected
with the appropriate controls
based on the classification of that data.
Different industries have different classification models.
So if you work in the commercial sector,
at a bank, at a college, or at a hospital,
you might see the information labeled differently.
Commercial and business classification models
often use labels like public, private, internal, restricted,
and confidential.
This system is a bit simpler to use
because unlike the military system,
most of these organizations are still going to rely
on a single computer network that handles all of the data
regardless of its classification.
Business systems tend to rely
on logical isolations and protections
instead of physical separations and protections.
For example, in the commercial or business model,
restricted or confidential data may use different
or higher levels of encryption for private or internal data.
The system for restricted data may be configured
using different types of access control rights
than for other classification levels.
All of this depends on how an organization wants to set up
with their classification levels.
For many businesses,
there's no mandated standard of classification
or standards of protection.
However, there are some commercial organizations
that are going to be directed by law
to protect data in a certain way.
For example, healthcare organizations in the United States,
such as hospitals or insurance companies,
are legally required to handle certain types of data,
like Protected Health Information or PHA,
in specific ways under the Health Insurance Portability
and Accountability Act, or HIPAA.
So remember, data classification is the process
of categorizing information based on its sensitivity, value,
or regulatory requirements.
The classification level assigned to data
determines how it should be handled and secured.
Different organizations use various classification models,
with the government or military and commercial
or business models being the most common.
The government or military model includes levels
such as unclassified, confidential, secret, and top secret,
with stricter controls for more sensitive data.
In the commercial or business model,
data is labeled as public, private, internal, restricted,
or confidential,
and the security measures applied here
may vary depending upon the classification level.