23 June 2020

Many organisations have limited resources to invest in safeguarding data. Knowing exactly what needs to be protected will help you develop a secure plan so you can allocate your budget and other resources wisely.

The best place to start is by classifying your data. Classification provides a solid foundation for a data security strategy because it helps to identify the data at risk in the IT network, both on premises and in the cloud.

In this article, we will give the data classification definition and explore the steps involved in getting started.

What is data classification?

Data classification is the process of organising both structured and unstructured data into categories. It enables more efficient use and protection of critical data, including facilitating risk management, legal discovery, and compliance processes.

For years, it was up to users to classify data they created, sent, modified or otherwise touched. Today, organisations have options for automating classification of new data that users create or collect.

What is data discovery? 

Data discovery is the process of scanning repositories to locate data. It can serve many purposes, such as enterprise content search, data governance, data analysis and visualisation. When combined with data classification, it helps organisations identify repositories that might contain sensitive information so they can make informed decisions about how to properly protect that data.

Data security

To safeguard sensitive corporate and customer data adequately, you must know and understand your data. You need to be able to answer the following questions:

  • What sensitive data, such as intellectual property (IP), protected health information (PHI), personally identifiable information (PII), and credit card numbers, do you store?
  • Where does this sensitive data reside?
  • Who can access, modify and delete it?
  • How will your business be affected if this data is leaked, destroyed or improperly altered?

Having answers to these questions, along with information about the threat landscape, enables organisations to protect sensitive data by assessing risk levels, planning and implementing appropriate data protection and threat detection measures.

Regulatory compliance

Compliance standards require organisations to protect specific data such as cardholder information (PCI DSS), health records (HIPAA), financial data (SOX) or personal data (GDPR). Data discovery and classification helps to determine where these types of data are located so you can make sure that appropriate security controls are in place and that the data is trackable and searchable as required by regulations.

Guidelines for data classification

There is no one-size-fits-all approach to data classification. However, the classification process can be broken down into four key steps, which you can tailor to meet your organisation’s needs as you develop your general data protection strategy.

Step #1. Establish a data classification policy

First, you should define a data classification policy and communicate it to all employees who work with sensitive data. The policy should be short and simple and include the following basic elements:

  • Objectives – The reasons data classification has been put into place and the goals the company expects to achieve from it.
  • Workflows – How the data classification process will be organized and how it will impact employees who use different categories of sensitive data.
  • Data classification scheme – The categories that the data will be classified into.
  • Data owners – The roles and responsibilities of the business units, including how they should classify sensitive data and grant access to it.
  • Handling instructions – Security standards that specify appropriate handling practices for each category of data, such as how it must be stored, what access rights should be assigned, how it can be shared, when it must be encrypted, and retention terms and processes.

Step #2. Discover the sensitive data you already store

Now it’s time to apply your classification policies to your existing data. You could choose to classify only new data, but then business-critical or confidential data you already have might be left insufficiently protected.

Rather than trying to manually identify databases, file shares and other systems that might contain sensitive information, consider investing in a data discovery application that will automate the process. Some technology tools report both the volume and potential category of the data.

Step #3. Apply labels

Each sensitive data asset needs a label in accordance with your data classification model; this will help you enforce your data classification policy.

Step #4. Use the results to improve security and compliance

Once you know what sensitive data you have and its storage locations, you can review your security and privacy policies and procedures to assess whether all data is protected by risk-appropriate measures.

Step #5. Repeat

Files are created, copied, moved and deleted every day. Therefore, data classification must be an ongoing process. Proper administration of the data classification process will help ensure that all sensitive data is protected.

Conclusion

Data classification is not a magic wand that ensures data security or compliance with regulatory requirements by itself. Rather, it helps organisations identify the data most critical to the business so they can focus their limited time and financial resources on ensuring appropriate data protection.