January 18, 2010 By Chris Poulin 3 min read

Back in my DoD days, I administered an AT&T 3B2 UNIX box whose raison d’etre was to provide multi-level security (MLS) for data ranging from unclassified to top secret. In that environment every Post-IT note, interoffice memo, email, or WordPerfect doc had to be labeled with a classification level and a compartment name, and every one of us had a clearance level. You could only read data that was at or below your classification level, and only if you had clearance for that compartment. And you could only write data to your level or above (you can’t demote the classification of data, which may let someone with a lower clearance read above their level), and again, only within the same compartment.

Fast forward to present time, and it occurs to me the private sector is finally getting wise to the concept of protecting the data, not the environment. The network perimeter has been eroding for years now, and architecture extensions are being cobbled together from VPNs, private B2B networks, and SSL gateways. But the promise—or threat—of cloud computing is challenging the notion that we can protect systems and forcing organizations to accept the fact that they’ll have to protect the data, wherever it may roam.

[mobile-mailto]

But not all data is created equal, and some should never be allowed to roam in the first place. More and more this common sense (hopefully) concept is being codified through data protection and privacy laws and contracts. PCI DSS mandates protection of cardholder data, HIPAA prescribes protection of patient data, and the Massachusetts privacy law, 201 CMR 17.00, enacts the protection of personal information for residents of the Commonwealth. If you’re subject to any of these—or other data protection or privacy controls—you could take the minimalist approach and simply define two types of data, and protect only the sensitive information. That works if you only feel an obligation to satisfy the law or contract; but if you take seriously the responsibly of protecting the information owned by your company or organization, this is the perfect time to undertake a data classification effort.

Data classification is at the heart of security: it’s the foundation of assessing your risk. I don’t necessarily mean a full-blown risk assessment, employing a comprehensive qualitative methodology; in the most basic sense, you just want to find out where you sensitive information is housed and how it flows. In mandatory access control terminology, the data is the object, and people are the subjects, and your next step is to decide who should have access to the data at different levels of classification. Again, you could take a minimalist approach and brand every employee with a check mark or a big red X, but you know the right answer is role-based access control (RBAC), which is pretty much universally mandated in security frameworks anyway, so you might as well put in a little extra effort and put RBAC in place now, before a government agency or business partner forces you to down the line.

When I look back at security clearances and data labels, it sure starts to look like where we’re heading today. Was it forward thinking? Or are security concepts like fashion: it’s basically all the same pieces in the wardrobe, and the fashions come around every so often. Whichever, the writing’s on the wall: you’re going to have to undergo a data classification effort sooner or later and start monitoring the access and flow of sensitive information. You may not need a military intelligence grade taxonomy, but I’m urging you to take the time and do it right: spend the extra effort to actually improve your information security program and controls. It will save you time and money in the long run.

More from Data Protection

Skills shortage directly tied to financial loss in data breaches

2 min read - The cybersecurity skills gap continues to widen, with serious consequences for organizations worldwide. According to IBM's 2024 Cost Of A Data Breach Report, more than half of breached organizations now face severe security staffing shortages, a whopping 26.2% increase from the previous year.And that's expensive. This skills deficit adds an average of $1.76 million in additional breach costs.The shortage spans both technical cybersecurity skills and adjacent competencies. Cloud security, threat intelligence analysis and incident response capabilities are in high demand. Equally…

Why safeguarding sensitive data is so crucial

4 min read - A data breach at virtual medical provider Confidant Health lays bare the vast difference between personally identifiable information (PII) on the one hand and sensitive data on the other.The story began when security researcher Jeremiah Fowler discovered an unsecured database containing 5.3 terabytes of exposed data linked to Confidant Health. The company provides addiction recovery help and mental health treatment in Connecticut, Florida, Texas and other states.The breach, first reported by WIRED, involved PII, such as patient names and addresses,…

Addressing growing concerns about cybersecurity in manufacturing

4 min read - Manufacturing has become increasingly reliant on modern technology, including industrial control systems (ICS), Internet of Things (IoT) devices and operational technology (OT). While these innovations boost productivity and streamline operations, they’ve vastly expanded the cyberattack surface.According to the 2024 IBM Cost of a Data Breach report, the average total cost of a data breach in the industrial sector was $5.56 million. This reflects an 18% increase for the sector compared to 2023.Apparently, the data being stored in industrial control systems is…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today