Many organizations have recognized that protecting sensitive information is a critical part of business operations and are now taking steps to ensure strong data protection strategies are integrated into everyday business activities. However, many companies fail to identify the sensitivity of data they are trying to protect, which results in wasted resources used to enforce same security controls around all data an organization possesses. With the word data doubling in size every 2 years, this can hardly be viewed as an efficient process. Different types of information require different security measures or sometimes no measures at all, e.g. a document containing all passwords hashes of all users in the organization and a customer-facing presentation should not be treated the same. That is why it is best to start by identifying what information needs to be protected. Data classification is an essential part of a successful data security strategy. Implementing an easy-to-use classification policy as the foundation of the organization’s data protection strategy will create an organized system to simplify the process of identifying sensitive data. The following steps are recommended for implementing a successful data classification policy:
- Determine project objectives
What is the desired outcome of the project? Defining a goal will help make sure the project stays on the right track and will ensure the correct information is collected and tagged. What is the scope of the project? Determine if it is feasible for the entire organization, or if it is best to concentrate initial efforts on specific departments.
- Define tool set
Determine what tools will be necessary to add classification into the everyday workflow, whether they are new or existing. Users are more likely to use a new tool if it is readily available within the tools they currently use. Data classification is an essential part of an effective data governance and security strategy, which also improves the performance and return on investment of other technologies such as Data Loss Prevention (DLP). It is extremely important for a new tool to fit into the existing classification and DLP frameworks, allowing companies to maximize return on the existing technology investments and allow users to embrace it with minimal work disruptions.
If your organization uses ERP systems such as SAP that store large amounts of data that require classification, it is also important to make sure new classification tools can be easily integrated with those systems.
- Develop unique classification labels and create consistency in the policies
Having multiple classification categories under similar names will cause confusion and incorrectly labeled data, lessening the overall effectiveness of a classification policy. A simple classification scheme broken down by distinct levels and departments makes it easy for users to decide what label to use, and as time progresses, more specific labels can be added, making sure to define what each category is for and what type of information belongs there.
When customizing the configuration of your classification policies, it is important to create consistency throughout the organization to avoid confusion and misplacement of data. Once the optimal labels and categories have been established, use the same names for all departments throughout the organization. It also must be decided if users will be immediately forced to add classification to data or if there will be default labels included in the configuration. What is decided for one department should be the same for all, to avoid inconsistencies in data classification.
It is highly suggested to require users to classify at the point of creation as users may disregard the importance of proper classification and allow the system to default all or many of the documents, which is essentially the same as having not classified the data at all.
- Start gathering and classifying data and metadata
Once the classification software has been deployed, it is time for users to begin classifying all data that is used, in emails and documents, and applying metadata tags where necessary. This forces users to consider the sensitivity of the information they handle on a regular basis and spread the information security responsibility throughout the organization, increasing awareness. Adding classifications to the metadata creates added security for sensitive information as it travels with the documents, allowing systems to understand the security measures necessary for sensitive data.
- Enforce the classification policy and take advantage of the benefits
The best way to ensure consistency in information handling across the entire organization is to deploy a classification tool that enforces users to classify information at the point of creation. In this case, users are immediately prompted to input classification labels based on the set customized scheme for the business. The customized classification parameters can be set by sensitivity, the level of confidentiality required for the data, and by domain, the department or user type with restricted access to different types of data.
Forcing users to classify every document, email, and download causes them to slow down and truly think about the nature of the information they handle and the sensitivity of what it contains. This brings security risks to the forefront and increases awareness throughout the organization.