3

Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity?

For example marketing may define "customer" data such as name and email address as not being sensitive while another department such as human resource may.

  • This is often defined on a national level by the local equivalent of the Information Commissioners Office, for precisely this reason. – Matthew Feb 4 '16 at 17:21
3

Building on @AdHominem's good answer, I would add that your organization should have a security policy that clearly lays out your information classification guidelines. It's common to define three or four levels, such as "public", "internal", "confidential", and "sensitive". With each level, the policy should state very clearly what can happen with information at that classification: 'public information can be shared with anyone without consequence', 'confidential information may not be shared with anyone outside of the department without director approval or higher', 'sensitive data must be encrypted at rest', etc. Your security policy should also define how to evaluate your data: "if releasing the data to the public would cause moderate reputation damage, it must be classified as confidential", "if releasing the data to the public would cause a violation of SEC laws, it must be classified as sensitive", that sort of advice.

You need the policy to be unambiguous in order to avoid protracted arguments over "why does my department have to pay the full cost for the encryption library when department X has the same data but doesn't encrypt it?"

Your security policy also has to take into account external regulations, laws, and contractual obligations. If the PCI DSS rules say "you must encrypt the account number with 2048-bit RSA", it doesn't matter if your data owner calls it confidential, your security policy must accommodate these regulations and enforce the required encryption.

Note that corporate classifications are generally different than military classifications. Military uses often include the concept of "clearance", which is a rating of the person who will have access to the data.

Also be aware that sensitivity may be context dependent. A postal code is public information. But the same postal code associated with the row of data associated with John Smith may be confidential, because it could damage your reputation to violate John Smith's privacy. And if the postal code is associated with John Smith's credit transaction, it might be considered sensitive according to PCI rules. HIPAA/Privacy rules are rife with these kinds of issues.

If your organization doesn't already have a security policy and you're asking these kinds of questions, it's time to implement one. If you need help, know that there are several resources on line, but you will obtain better results using a qualified CISSP to help create one. Also, be aware that your security policy will come into play if there's ever a lawsuit resulting from a breach. Not having a policy will almost certainly be called out by the plaintiffs as a sign that your organization is irresponsible with data security. You need your organization's lawyers to be on board with it. (Defending against lawsuits is just another ugly part of risk management.)

And if your organization does have a security policy, it is already your responsibility to read it, understand it, and follow it. If it doesn't have information classification spelled out clearly, speak to your Info Sec people and ask them to review it for inclusion it in the next update of the policy (the security policy should have a policy review frequency written in it.)

4

Sensitivity of data is determined by the data owner who is responsible for classifying the information and also liable in case the information gets compromised. So no matter if data is used by human resources department or marketing, the classification will stay the same. The relevant metric for estimating the sensitivity is closely related to the cost of the data, id est:

  • the necessary effort to reproduce the data if lost
  • the financial cost of acquiring the data initially
  • the reputation loss in case of a successful incident
  • the intellectual property that might get infringed

All these metrics vary in gravity according to the institution. For example R&D data is hard to reproduce, impossible to rebuy and you lose intellectual property, so it should be classified as confidential. The reputation loss plays a minor role. When patenting is over, the classification will be much lower.

  • Thanks. What about shared data i.e. data owned and managed by multiple parties? – Motivated Feb 5 '16 at 20:00
  • Thats the problem and the reason why there are so many voices against TTIP. Sensitivity is defined in the scope of an institution, not of a nation or even global. Privacy would be a solved problem if sensitivity of data would be the same for all people. But for example European citizens are much more reluctant to give away their data than Americans. – AdHominem Feb 5 '16 at 22:50

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.