- Chapter 1: Resource Inventory
- Assigning Ownership
- Determining Value
- Security Classification
Security Classification
All resources do not have the same potential to cause an organization monetary loss and therefore all resources do not require the same expenditure for their protection. Resource owners must consistently convey the relative importance of loss through modification, destruction, disclosure, or unauthorized use of their resources to the company. Classifications are organized around the attributes of confidentiality, integrity, and availability as they relate to the organization's resources.
Assigning classification is only the first step into a classified environment. It is the continual, day-to-day use of the security classifications that is difficult. The information's classification determines how it is handled, transmitted and stored, who has access, and where the information is allowed to go. Classified information must be labeled appropriately, and this label must follow the information wherever it goes, in whatever form it takes, including printed information and screen displays.
Security classifications allow for a logical grouping of resources to assign general security levels so that information of a given classification always receives a defined minimum level of security. Most companies do this to some degree - papers are marked "Not for Publication" or "Company Confidential." In general, however, this security is only loosely used and minimally enforced.
Classification is conceptually very easy. Determine the value and risks and assign an appropriate classification. However, information has varying degrees of importance and sensitivity, and a classification system must be used to ensure that the information receives an appropriate level of protection. Classifications may be used to indicate the need and priorities for security protection.
The following factors should be considered when assigning a resource's security classifications:
-
Sensitivity of the information is the leading factor when setting the level of security classification for the information.
-
Consequences of disclosure define the financial impact of a loss to the information. This helps set the value of the information and thereby sets the appropriate costs of the safeguards to protect it.
-
Legal and contractual obligations and penalties will define the minimum level of security required for the information to which the law or contract applies. Besides specific laws that place security requirements on information, such as the Privacy Act of 1974, there are laws, court cases, legal opinions, and other similar legal materials that may affect the security classification directly or indirectly.
-
Standards and guidelines that are defined by government, industry, locality, or the organization itself will help determine the security classification for the information. They will likely define features, assurances, and operational practices for specific types of information. Many organizations specify baseline requirements for systems that have specific functions.
-
Information lifecycle affects the security classification of the information, since the importance of the information changes over time. Generally, the closer the information is to being officially made public, the lower its security classification will be.
An information resource's overall security classification is the combination of a resource's individual availability, integrity, and confidentiality classifications.
Confidentiality
The confidentiality classification describes the impact from disclosure. It could be in the form of business losses from disclosed proprietary information or the personal damage caused by disclosed private information. Confidentiality classifications are what is generally thought of when the term "security classification" is used.
Availability
The availability classification indicates the urgency of the information and the systems that utilize it. The measure for availability is often based on the lost revenue or productivity that would result from an outage.
Integrity
The integrity classification reflects the severity of the damage that would be caused if the information was altered and then utilized. The damages derive from inappropriate decisions or behaviors based on faulty information. Compromised integrity can be responsible for everything from financial damage to loss of life.
Classification, and the periodic review of classifications in conjunction with risk assessment, will lead to appropriate expenditure in its protection, rather than unnecessary expense. Information classification requirements change over time so it is necessary to review these needs and reclassify information that has had a change in its requirements.
It is best to avoid using military classifications; they have very rigid definitions that may not fit a nonmilitary environment. Their use will create preconceived expectations of the information or its handling.
