4

I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES encryption algorithm in addition to the sandbox model.

The best is to allow the application user to configure data to be critical or not. But I am wondering if anyone is aware of a survey or anything similar that categorize data in terms or critical or not critical. So far I am considering two categories in order not to make it so complex, but if there are some standard classification I would be a taker as well.

Improve this question
2
  • 1
    Who are the application users? What types of data is the application using? Are you classifying data just for the application or for the application, the operating system, the network stack, etc?
    – this.josh
    Jul 13, 2011 at 17:05
  • it varies so much that i said i want the customer to decide
    – smiley
    Jul 13, 2011 at 19:01

4 Answers 4

Reset to default
8

Data classification is essential to guide you in terms of resource expenditure - you don't want to spend heavily to protect assets that are of low sensitivity.

The Confidentiality, Integrity and Availability model is very commonly used, however it doesn't really help you define classification standards for your envirnment. You may want to look at at specifics for your needs. For example:

  • If you hold customer credit card data, PCI-DSS requires it to be protected so you might want to classify it as high.
  • Similarly personal medical data should be protected (many jurisdictions mandate this through law)

An alternative, if you aren't holding data which comes under regulation, is to classify by business impact. For example:

  • Data which would heavily impact the business if divulged or destroyed
  • Data which can be public without impact to the business
Improve this answer
0
2

I think you only need two categories: private and not private.

  • If the user marks the data as private then you encrypt it.
  • If they mark it as not private then don't encrypt it.

The sandboxing happens regardless of what the data is.

Unless you are planning to implement other data protection mechanisms any further categories will not change how your application handles the data.

Improve this answer
5
  • 1
    Why not encrypt everything? Why force the user to make unnecessary decisions? This doesn't seem terribly user-friendly.
    – D.W.
    Jul 15, 2011 at 6:15
  • Mainly because that is what the question calls for: categories for a user to mark data. Alternativly encryption and decryption has cost especially on mobile devices. Loosing or forgetting a key or password will render you encrypted data useless, so why trade availability for confidentiality if you don't have to>
    – this.josh
    Jul 15, 2011 at 7:38
  • 1
    I know that the question asked for ways to mark the data, maybe the best answer is to question its premises and point out that maybe marking data isn't what you should want. Symmetric-key encryption is extremely fast, even on mobile devices. It has a perception of being slow, but often the perception is wrong. Unless you have data to prove that it is a performance problem, I'd be pretty skeptical. Bothering the user, or creating a poor user experience, has a much higher cost than spending a few cycles encrypting data.
    – D.W.
    Jul 15, 2011 at 16:09
  • off course i will provide a default and the end user can modify them. Otherwise regarding the symmetric encryption, do you have some indication on performance? some test figures somewhere?
    – smiley
    Jul 17, 2011 at 2:24
  • @D.W. I usually try to answer the question asked. Often I feel that asker really needs something else, and sometimes I try to repsond to what I think the real problem is. When I said cost on mobile devices, I didn't mean speed, I meant battey power, the most precious resource of a mobile device.
    – this.josh
    Jul 17, 2011 at 5:02
1

Keep a scale for Confidentiality (C), Integrity (I) and Availability (A). Keep a scale upto 5 and let the application user choose the C,I,A values. For example, Consider a Data xyz which is Highly Critical in terms of confidentiality, integrity and availability so the user can have Data XYZ, C=5,I=5,A=5 (on the scale 1-5 and 5 being Max). Now come out with a formula like C+I+A, Lets have a Map Criticality. Criticality = C + I + A. Crticality greater than 7 means its Critcal. Criticality Lesser than 7 means Non Critical.

The Formula for this can be changed as you want which will fit your business need.

Improve this answer
1
  • 3
    customers typically do not talk in CIA but rather business impact, so answer from Rory is more convincing.
    – smiley
    Jul 13, 2011 at 13:12
1

You can use the classifications that the Military use.

  • Top Secret (lots of soldiers die, a politician loses his job)
  • Secret (A number of soldiers die, a politician has to explain to wifey)
  • Sensitive (a number of soldiers might die, a politician is embarrassed)
  • Confidential (a general is embarrassed)
  • Restricted (a major is embarrassed)
  • Not Classified (even the 2nd lieutenants know)

And I would additionally label the information subject to the various laws/obligations (HIPPA, PCIDSS, SOX etc)

p.s. Please don't be offended by the mild joking above, I respect the work and the lives lost to protect me and my family.

Improve this answer
1
  • not really what i am looking for --sorry but thanks anyway
    – smiley
    Jul 13, 2011 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .