‍What is data cassification? 

^‍

In a broad sense, data classification is the process of classifying data into predefined categories so that it can be utilized and protected more effectively. The data classification process facilitates finding and retrieving data, which is crucial for risk management, compliance, and data security.

‍

Data classification frequently entails a multitude of labels and tags that specify the type of data, its integrity and its confidentiality. The sensitivity level of data is classified based on the changing levels of relevance or confidentiality, which correlate to the security measures that have been put in place for each classification level.

‍

What are the main categories of data classification?

‍

Data Classification generally includes the following:

‍

• Public Information - This type of data is often kept by companies and government organizations and can be openly and publicly shared if required by law. Public information does not require any restrictions when used.

‍

• Confidential Information - Internal information that should only be used within the company or the organization and may include company materials and pricing, is considered confidential. Legal limitations on how this data is handled may exist, since - if disclosed - this information could negatively affect the company. 

‍

• Sensitive Information - Any highly sensitive data that is typically protected with a Non-DisclosureAgreement and is kept or handled by a government agency or other organization, is considered sensitive. If revealed, the organization may suffer serious financial or legal repercussions. Thus, this information is under strict restrictions on usage and authorization requirements.

‍

What are the main sensitive data classifications? 

‍

PII (Personally Identifiable Information), PHI (Personal Health Information) and PCI (Personal Credit Information) are the three main categories of sensitive data. Each of these categories has its own set of compliance requirements that enable businesses to make the most of customer data while protecting it from cyber attacks.

PII

• A person's name, address, Social Security number, phone number, email address, or any other number or code that can be used to directly identify a person is considered PII. Along with other types of information, such as gender, race, date of birth, and location, PII is data that an organization can use to identify specific people. PII also includes any contact details that can be used to locate a person physically or online.
• In order to safeguard PII against unauthorized access, use, deletion, alterations, or other data breaches, organizations may be legally required by regional or national laws to maintain specific security controls.

‍

PCI

• The sensitive data in the PCI category includes cardholder data such as the cardholder’s name, their primary account number, and the card’s expiration date and security code. It also includes sensitive authentication data such as magnetic-stripe data and the equivalent data contained on a chip, or PINs.
• In order to prevent credit card fraud, the PCI Security Standards Council (SSC) created the Payment Card Industry Data Security Standard (PCI DSS) in 2004. PCI DSS is a security standard used by payment card companies around the world to securely process, store, and transfer cardholder data. All credit cards have PCI DSS security measures in place to protect cardholders from card fraud and identity theft. 

‍

PHI

• Any health-related information generated or acquired by any entity protected by health privacy statutes. PHI includes any demographic data that relates to the physical or mental health of a person in the past, present, or future and any medical care that someone receives during their life.

‍

Secrets

• Secrets are the credentials that organizations employ to carry out digital authentication anytime privileged users need to access critical corporate data or delicate applications and services. Secrets can exist in a variety of formats, such as passwords, API keys, tokens, SSH keys, private certificates, and encryption keys. Securing secrets is critical to the overall security of any business, and IT teams frequently use secrets management technologies in their DevOps settings.

‍