#data classification policy

[secureislands-blog]

A Data Classification Policy Is The First Step To Data Loss Prevention

Having a data loss prevention product in place is critical for organizations today, but one should not even tempt the idea of implementing that product until they have an effective and workable data information security classification policy in place.  Your DLP program will rely heavily on the administrative and technical controls provided by data classification software.

What Is A Data Classification Policy?

A data classification policy (also common referred to as a data security classification policy) makes it possible for all sensitive information within an organization to be handled correctly and according to the risk is poses to an organization.  Every piece of sensitive information in an organization come with a “risk level” label which then allows your DLP to determine:

1.      Which methods are best to protect that information; and

2.      Which allowable resources will be used

3.      The level of encryption necessary

4.      The storage/transmittal requirements of that data

How Can Data Be Classified?

Organizations can have as many or as few risk classification levels in place as they deem necessary, but most will have the following three in place:

Public Data Classification

Data digitally stamped with a public classification label is information which is available to the general public and which is intended to be distributed outside of an organization.  Some examples of this would include:

·         Press releases

·         Sales brochures

·         Job announcements

Any information which falls under this category is produced for the public and can be freely distributed without harming your organization.

“Business Use Only” Data Classification

Information which falls under this category is used in business processes and, if exposed to the public, destroyed or modified, will not result in significant harm to the organization, its employees, business partners or customers.  Some good examples of “business use only” data includes:

·         Company phone lists

·         Internal policy manuals

Confidential Data Classification

This label applies to data which is used in sensitive business processes.  Any unauthorized modification, disclosure or destruction of information in this category will have an adverse affect on the organization, its employees, business partners and/or customers.  Examples of confidential data include:

·         Personally identifiable information

·         Intellectual property

·         Contractual negotiations

·         Bank account numbers

Save Yourself Time With A Data Classification Solution

Tagging and labelling every piece of data which exists on your network today is extremely time consuming if not downright impossible.  That is why data classification solutions exist.

A data classification solution is an enterprise-level tool which is incredibly complex and far-reaching.  The most reliable tools on the market are usually hybrid tools which are intuitive, always learning and automatic while giving the option of manual classification.

When looking into your options, look for one which is:

·         Automatic and offers transparent classification

·         Allows for manual user-determined classification

·         Has a recommendation option which will suggest appropriate classification options for you to confirm

Most importantly, in order to save time, the solution should automate the selection of the classification for each instance (whether that be manual classification, automatic classification or user prompted classification) based on the type of data which is being classified.

[threatprotection-blog]

Data Classification Policy

These days we tend to be somewhat blasé about the information stored on business computer networks, but have you considered how sensitive much of it can be? We read all the time of cases of data and information theft plus DDoS attacks – sometimes in relation to major corporations who one would think have the best available security. The information on your system may be of interest to many unscrupulous persons.

Make no mistake, small and medium sized businesses are just as likely to be targeted as bigger corporations. The smaller the business the more likely it is to have lax network security, and there will be information to be found that can be of interest. Pay attention to public WiFi hotspots also, as these are prime targets for hackers and make for easy pickings as they are notoriously insecure. So, what do you do to ensure the highest level of data protection?

Information security classification systems effectively apply a classification to all data at source, and in doing so set up a viable user restriction system by which only those with access can view the information therein. This is the first step in ensuring your network and information is secure.

Sometimes it is easy to forget that, in addition to threats from outside, there is also the problem of data security problems from within the organisation. Instances where persons access information they do not have authorisation for are occurring all the time – sometimes by deliberate acts, others by mistake – and a data classification policy will help guard against this.

There is plenty of information regarding salaries, personal details of employees, contracts, production schedules, suppliers stored on every network, and often in the form of commercially available software packages such as Microsoft Office, PDF files, Microsoft Outlook and others. As these are well known and in the public domain they are vulnerable, so you need the very best data classification policy you can implement.

A data security classification system will classify and immunize every file that is created at source; this will also include usage rights. These usage rights are to stay as stated for the lifetime of the data packets involved, and hence there is no chance of anyone who is not authorised getting their hands on the information within. Furthermore, accidental access is also no longer possible.

The immunization also applies to many functions, for example a certain individual may be able to read a document but not change, print or save it. This is a further benefit of the top level data security policy solutions, and one that is very much welcome. Such innovation in developing software so capable means that in the unlikely event somebody happens to see sensitive information, they cannot duplicate it anywhere else.

Information security classification is a valid and proven method of ensuring the highest levels of security protection for information stored and transferred within your organisation. It is both affordable and efficient, and also highly automated so takes little in the way of manpower. The fact is that the threats will continue to become more sophisticated and innovative, but information security classification solutions mean the possibility of accessing information and using it against the owners is only going to become more difficult, so check out the available systems now and  make sure yours is thoroughly up to date.