Chapter 3 – Data Classification Flashcards
Data Ownership
assign responsibilities according to who has possession and legal ownership of that data.
Data Owner
org that collected/created the data; usually department head/business unit manager; cloud customer is usually the data owner (international treaties/frameworks refer to as the data controller)
Data Custodian
person or entity tasked with the daily maintenance/administration of the data; role of proper security controls and processes as directed by the data owner; sometimes a database admin
Data Processor
any org or person who manipulates, stores, or moves the data on behalf of the data owner; cloud provider is a data processer (international law)
Data processors do not necessarily all have direct relationships with data owners; processors can be third parties or further removed down the supply chain
Data Lifecycle
understand it in order:
Create > Store > Use > Share > Archive > Destroy
Create
data owner will be identified in this first phase; data security and management responsibilities require action; data owner will categorize the data
Data Categorization: Regulatory Compliance
can categorize by specific datasets (GLBA, PCI, SOX, HIPAA, GDPR, other international, national, and local compliance)
Data Categorization: Business Function
different use of data (billing, marketing, operations)
Data Categorization: Functional Unit
department or office with its own category and data controls
Data Categorization: By Project
define datasets by projects associated with as means of creating discrete, compartmentalized projects
Data Categorization: Data Classification
responsibility of the data owner; assigned by the org’s policy based on characteristics of dataset
Sensitivity: used by the US military; assigned to the sensitivity of the data, based on negative impact an unauthorized disclosure would cause
Jurisdiction: geophysical location of the source/storage point of the data might determine how the data is handled; PII gathered from citizens from EU is subject to the EU privacy laws
Criticality: data deems critical to org survival classified in a manner distinct from trivial, basic operational data; BIA helps determine this
Data Categorization: Data Mapping
data between organizations (or departments) normalized and translated so it is meaningful to both parties; in classifications, mapping is necessary so data that is sensitive must be protected in one org must be recognized by the receiving org
Data Categorization: Data Labeling
when data owner creates, categorizes, and classifies the data, it also must be labeled; should indicate who the data owner is (office or role, not name or identity); should take any form to be enduring, understandable, and consistent; Ex: labels on hardcopy data might be printed headers/footers, labels on electronic files might be embedded in the filename/nomenclature; labels should be evident and communicate pertinent concepts without disclosing data they describe;
Data Categorization: What may data labels include?
Date of creation
Date of scheduled destruction/disposal
Confidentiality level
Handling directions
Dissemination/distribution instructions
Access limitations
Source
Jurisdiction
Applicable regulation
Data Discovery
used to refer several kinds of tasks to determine and accurately inventory the data under its control; org is attempting to create an initial inventory of data it owns, org is involved in electronic discovery (e-discovery), and can modern the use of datamining tools to discover trends and relations in the data already in the org’s inventory
E-Discovery: legal term for how electronic evidence is collected as part of an investigation/lawsuit
Label-Based Discovery
labels created will aid in any data discovery efforts; org can determine what data it controls and amounts of each kind; labels are useful when the discovery effort is undertaken in response to a mandate with specific purpose (court order/regulatory demand); can easily collect and disclose all appropriate data if labeled
Metadata-Based Discovery
data about data, a listing of traits and characteristics about specific data elements/sets; can be useful for discovery purposes; data discovery uses metadata the same way as labels to scan field for particular terms for certain purposes
Content-Based Discovery
discovery tools can be used to located and identify specific kinds of data by delving into the content of datasets (even without labels/metadata); basic term searches or sophisticated pattern-matching technologies
Data Analytics
technological options to provide additional findings and assigning types to data; modern tools create new data feeds from sets of data that already exist within the environment; modes used are real-time analytics, datamining, and agile business intelligence
Datamining
an outgrowth of the possibilities offered by regular use of the cloud (big data); when org collects data streams and run queries across the feeds, the org can detect and analyze previously unknown trends and patterns that can be useful
Real-Time Analytics
tools can provide datamining functionality concurrently with data creation and use; the tools rely on automation and require efficiency to perform properly
Agile Business Intelligence
tate-of-the-art datamining involves recursive, iterative tools and processes that can detect trends and identify more oblique patterns in historical and recent data
Jurisdictional Requirements: USA
address privacy with industry-specific legislation (GLBA for banking/insurance, HIPAA for medical care, etc.) or with contractual obligations (PCI); granular data breach notification laws exist that are enforced by states and localities (New York/California); strong protections for intellectual property
Jurisdictional Requirements: Europe
has massive, exhaustive, comprehensive personal privacy protections (EU General Data Protection Regulation); good intellectual property protectio
