283
Appendix D
Data Classification
Data classification is the basis for determining how data is treated — e.g., how long
it is retained, how it is handled (confidential, public, etc.), and how it is protected.
It is based on operational, regulatory, and other business requirements and impacts
many areas of a company. Some groups that may have significant input in data
classification policy include finance, information technology (IT), and human
resources. These groups have operational and regulatory requirements with different
data including some of the examples listed below:
• Financial records
• Personnel records
• System logs
For example, the finance group has classification requirements driven by oper-
ational needs related to financial analysis and regulatory requirements related to
taxation and Securities and Exchange Commission (SEC) reporting (if it is a publicly
traded company).
Some of the key risks of not having a sound data classification process include:
• Loss of critical data due to inappropriate treatment
• Compromise of confidential data during transmission or destruction due
to a lack of appropriate security measures
• Inappropriate disclosure of information as a result of lack of classification
or no classification, resulting in fines or damage to a company’s reputation
or legal exposure
This questionnaire is based on the International Standards Organization (ISO)
17799 standard and past experience and is meant to serve as an initial set of questions.
These questions should be asked of people who are significantly involved in the data
classification process. This questionnaire should be modified to the extent necessary
to reflect the specific client’s business based on what you have learned so far.
1. Is a data classification policy in place?
Guidance:
A data classification policy is required at the minimum in order
to have consistent and enforceable classification practices. It is possible
AU1706_book.fm Page 283 Wednesday, July 28, 2004 11:06 AM
284
A Practical Guide to Security Assessments
that there is no documented scheme but there is some scheme that personnel
generally know about and follow. The policy helps ensure that all person-
nel are using the same classifications. If there is an “ad-hoc” or unwritten
policy in place, it can potentially be leveraged to create the security policy.
Risk:
The risks associated with not having a data classification policy
include:
• There is a lack of or inconsistent data classifications being used, which
can result in data not receiving appropriate treatment relative to oper-
ational, legal, and other requirements.
• It is difficult to enforce consistent data classification practices without
a formal policy that has been communicated to personnel.
Client Response:
2. Are any procedures in place to show users how they are to classify
information and communicate it to the relevant people in the organization?
Guidance:
In order for personnel to understand how to implement the data
classification policy, a process they can follow should be documented and
readily accessible. The procedure should articulate responsibilities (e.g.,
data owners, IT) and define a process for classifying data and communi-
cating the classification to the appropriate parties. If there is already a pro-
cess that is working well, it should be formalized into a documented
procedure. The documented procedure will make users accountable to a
process and help ensure that personnel know about it and that it is done
consistently. The other value of procedures is when there is employee turn-
over. Documented procedures can be used by new employees to quickly
come up to speed.
Risk:
Without documented procedures, there is a risk of:
• Noncompliance with the data classification policy
• Incorrect or inconsistent data classification processes
Both of these cases can result in data not being classified properly and
not receiving the appropriate treatment.
Client Response:
3. Does your company have any operational, regulatory, or other require-
ments that might dictate the need for data classification?
AU1706_book.fm Page 284 Wednesday, July 28, 2004 11:06 AM
Appendix D
285
Guidance:
This question should help determine how important data clas-
sification is for the company. Some smaller companies might treat all data
in the same way and may not have any need for data classification. In larger
companies, data classification is probably something to be concerned
about, as they are more likely to have those types of requirements.
Risk:
Not applicable. This question is to help determine the scope of data
classification in the company.
Client Response:
4. Have there been any security incidents recently that could potentially have
been prevented if a data classification policy was in place? If so, what
steps have been taken to prevent such incidents from happening again?
Guidance:
If an incident has occurred, the nature of the incident, the com-
pany’s response, and subsequent actions to prevent it from happening
again are important to discuss and may lead to findings for the assessment.
For example, colleges and universities are always handling sensitive stu-
dent information — e.g., grades, disciplinary information. The risk related
to exposing sensitive student information can be reduced if student infor-
mation is classified so that it receives the appropriate level of security.
Risk:
Not applicable. The purpose of this question is to gather informa-
tion. There is no associated risk.
Client Response:
5. Do users know the data classification scheme and is it published and
easily accessible?
Guidance:
Sometimes a data classification scheme exists but few know
about it because it is buried in some obscure intranet site or in some man-
ual, which only a few people have. It is possible that the policy is not with
the rest of the security IT policies or operations policies because it was de-
veloped by the legal department. Users might want to classify information
but if the scheme is not easily accessible, they may not take the time to find
out about it and thus may not use it. There may be a need to incorporate
data classification into a user awareness program and into existing security
policies.
AU1706_book.fm Page 285 Wednesday, July 28, 2004 11:06 AM
286
A Practical Guide to Security Assessments
Risk:
If users are not aware of the data classification policy and if it is not
easily accessible, there is a risk they will not follow it because they do not
know about it or are not willing to take the time to find out about it.
Client Response:
6. Does the classification scheme provide enough guidance so users can
easily classify information?
Guidance:
When users access the data classification policy, it would be
helpful for them to have some criteria or examples to help them classify
information and distinguish the differences between the various classifica-
tions. As users begin to classify data, real examples, which can be used as
reference points by personnel, will become available. One sign of a lack of
guidance is that people are not using the existing classification scheme
because the meaning of the classifications is unclear. If no guidance exists
and personnel are unclear on classifying data, it would be worth incorpo-
rating this into a user awareness program and incorporating examples into
the classification policy.
Risk:
Without some guidance or examples of data for each of the classifi-
cations, personnel might not classify data properly. This can lead to incon-
sistent data classification and data not getting appropriate treatment.
Client Response:
7. Are specific roles and responsibilities defined for data classification —
specifically for data owners and system owners?
Guidance:
Data classification, like other areas of security or operations in
general, requires clear roles and responsibilities to ensure that key tasks are
performed. In the case of data classification, there must be personnel who
“own” the data and are thus responsible for classifying it. One thing to look
out for is that data classification might be viewed as an IT problem and as
a result, IT is responsible for classifying the data. IT should not be making
data classification decisions because they do not have the expertise to do
so nor do they own the data. The IT group’s responsibility should be to pro-
vide the necessary level of protection for data based on the classification.
In addition, data owners should understand that there are costs related to
different classifications — e.g., there are additional costs related to pro-
tecting confidential documents versus public documents.
AU1706_book.fm Page 286 Wednesday, July 28, 2004 11:06 AM
Appendix D
287
Risk:
Without clearly defined roles and responsibilities, there is a risk that
data will not be classified properly and will not receive the appropriate
treatment.
Client Response:
8. Is the data classification scheme used consistently across the whole orga-
nization?
Guidance:
As a best practice, one data classification scheme should be
used consistently across an organization. An example of multiple classifi-
cations is when a company is classifying confidential data. One group
might call it “confidential,” but another group might call the same type of
data “proprietary and confidential.” This will just confuse some personnel
and potentially result in the creation of other classifications. In addition,
with these rogue classifications, it is difficult to determine what the impli-
cations are for the various classifications — i.e., how that data is protected.
If other classifications are developed, they should go through the appropri-
ate reviews, and personnel should be provided with some education on
them.
Risk:
Without a consistent data classification scheme, which has gone
through appropriate reviews, there is a risk that data will not receive appro-
priate treatment as it is unclear what the classifications mean.
Client Response:
9. Does the classification scheme address the following processes for each
classification?
• Copying and storage of information
• Retention of data
•Transmission of data
• Destruction of information
• Sensitive information
Guidance:
One of the purposes of the classification scheme is to define
how data should be handled. Based on how data is classified, the company
should have certain guidelines for key data processes such as the ones listed
above. If a user classifies data with a certain classification, the user should
have an understanding of how the data will be treated and what the finan-
cial and process implications might be. For example, when “confidential”
AU1706_book.fm Page 287 Wednesday, July 28, 2004 11:06 AM
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.