In this lesson,
we will learn about labeling and tagging.
Data labeling and tagging
involves assigning markers to data
to indicate its classification, sensitivity,
or handling requirements.
Additionally, labeling and tagging
ensures proper data management and protection.
Now, in addition to understanding that data classifications,
like confidential, secret, and top secret,
require different levels of protection,
let's explore how these classifications
and related tags are applied to data.
Spoiler alert, this is done through labeling and tagging.
Data labels can be applied either manually or automatically,
depending upon how the systems are configured.
In many systems, data labels are automatically set
based on a list of certain terms known as a dirty word.
For example, let's say I am going to send you an email
and I write the word bazooka in the email.
If bazooka was on your list of secret classified terms
or on your dirty word list,
the email would automatically be labeled as secret
because it contains a secret word, bazooka.
However, automatic classification labeling
isn't always the most effective method to use
because the system might not know
whether I meant bazooka the weapon
or Bazooka the chewing gum.
If I were referring to the chewing gum,
then the email doesn't need to be classified as secret.
Manual labeling occurs when the end user creates the data
and adds a text-based classification label on their own.
So if you created a document
that had the new marketing strategy for your company
and you only wanted top level executives
to see that document, you might label it as top secret.
In the military, every document has a classification label
in both the header and the footer of the document.
This might be unclassified, secret, or top secret labeling.
This labeling ensures that everyone who sees the document
knows its classification level and can protect it properly.
In addition to labeling documents
with a classification label,
they can also be labeled with declassification requirements.
This label will indicate
when the data can be downgraded to an unclassified
or lower level.
Declassification typically occurs
when the data is no longer useful.
Let's look at an example
to understand the importance of declassification.
In 1944, the Allied forces invaded France
on the beaches of Normandy.
The invasion was known as Operation Overlord.
The invasion plans were highly classified
to ensure the Allies could launch a surprise attack
against the Axis powers.
Any documents created for Operation Overlord
were labeled as top secret.
While it made sense
to keep this data highly classified during the war,
after the invasion, there was no need
to keep the information classified,
so its classification was changed to unclassified.
You can easily find the plans online today
and read through them.
So declassifying old data frees up resources
that can then be used to protect current
and more important information.
By declassifying war plans such as Operation Overlord,
historians and anyone who is interested
can now read the plans.
While classification labels are broad,
such as secret or top secret,
data tags can be used to provide additional detail
on how the data should be protected.
A data tag can further specify requirements
for a piece of data within a classification.
For instance, the documents for the Normandy invasion
had a data tag.
These documents were all tagged with the acronym BIGOT
which stood for British Invasion
of German-Occupied Territory.
So the data was labeled as top secret,
indicating a level of classification,
but it was also given the tag BIGOT
so that people would know the contents
related to the invasion.
Any document with the data tag BIGOT
required additional special handling.
Similarly, certain industries use data tags
to indicate special handling instructions.
For example, companies may have data tags like PII,
or Personally Identifiable Information,
SPI, or Sensitive Personal Information,
PHI, or Personal Health Information,
and financial or restricted data.
Although these tags may be on documents
that are labeled unclassified,
the data tags tell people handling that data
that it still needs protection.
This is because tags help indicate
the additional levels of protection
that are required for specific data.
For example, in a hospital,
your medical record is not top secret,
but it should still be protected,
so it receives the data tag PHI,
or Protected Health Information,
to ensure that it receives the additional protection
that is required by law for medical records.
Now, even within highly classified data labels,
there are tags that indicate
even higher levels of protection.
For example, under the top secret classification label,
you might find tags like SI, or Special Intelligence,
TK, or Talent Keyhole,
and HCS, or Human Intelligence Control System.
While you don't need to memorize these tags for the exam,
they demonstrate that tags exist
across all classification levels,
including unclassified data,
providing even more refined handling requirements
than the classification levels themselves do.
When dealing with technology,
there are various technical solutions available
for managing and protecting data using labels and tags.
For example, Microsoft's Data Loss Prevention,
or DLP solution,
includes over 70 sensitive information types,
such as PII, SPI, and PII,
under the unclassified category.
Another key design factor to consider
is the format of your data.
Format refers to how the information is organized
based on specific structures or standards.
Data formats fall into two main categories,
structured and unstructured data.
Structured data follows a predefined model.
For instance, A CSV, or Comma-separated value file,
organizes data in a predictable way,
with each piece of information separated by commas.
If I exported a list with a person's name, address,
and phone number in CSV format, it might look like this.
Jeremiah Minner, 123 Main Street,
555-111-1234.
This predictable structure
makes it easy to manage and process data in this format.
Unstructured data, by contrast,
is not organized by a specific model at all,
and it can include formats like PowerPoint slides,
Word documents, emails, text files, and chat logs.
Unstructured data is highly flexible
because it does not need to follow a specific format.
Because of the differences
between structured and unstructured data,
as well as the differences between labels and tags,
various systems and classification mechanisms
must be established
to interpret different data types and formats.
So remember, data labeling and tagging
are used for marking data
with classifications such as confidential,
secret, or top secret,
and for managing that data sensitivity
and handling requirements like PII and PHI.
In the end, labels and tags ensure that data is protected
according to its level of importance.
Furthermore, data labeling
can be done automatically or manually,
depending upon the system set up,
and tags provide specific detail
about the protection required for specific data
even more so than a classification label does.
Next, declassification plays a role
when classified data is no longer sensitive
and can be made public.
And finally, both structured and unstructured data
require different systems to manage their classification
and protection properly.