登录查看更多内容

How can you create a data classification policy that protects your network?

由人工智能和领英社区提供技术支持

A data classification policy is a set of rules and guidelines that define how your organization handles and protects different types of data on your network. By creating and implementing a data classification policy, you can improve your network security, compliance, and efficiency. In this article, you will learn how to create a data classification policy that protects your network in six steps.

此文章中的业界达人

由社区从 3 条内容中精选。了解更多

Shoumit Karnik

顾问 | Deloitte

1 Identify your data sources

The first step is to identify where your data comes from, where it is stored, and who has access to it. You can use various tools and methods to scan and inventory your network devices, servers, databases, applications, cloud services, and external partners. You should also interview your stakeholders and data owners to understand their data needs and expectations.

添加您的观点

Shoumit Karnik

顾问 | Deloitte
举报内容
To identify data sources following options can be used: - Network audits/assessments - Network Scanners: Tools like Nmap, NetCat, OpenVAS, or Nessus - Network Monitoring Solutions: Platforms such as SolarWinds, PRTG Network Monitor, or Nagios

已翻译

赞

2 Define your data categories

The second step is to define your data categories based on the level of sensitivity, confidentiality, and risk associated with each type of data. You can use a standard framework such as ISO 27001 or NIST 800-53, or create your own custom categories. For example, you can use four categories: public, internal, confidential, and restricted. Each category should have a clear description, criteria, and examples of data that belong to it.

添加您的观点

Shoumit Karnik

顾问 | Deloitte
举报内容
An additional category which is generally helpful to define is User Identifiable Information(UII) or Personal Identifiable information(PII). An organization should have a clear definition of what it considers PII/UII, which should align with a framework (ISO 27001:2022 or NIST SP 800-122 or GDPR)

已翻译

赞

3 Assign data owners and custodians

The third step is to assign data owners and custodians for each data category. Data owners are responsible for defining the data classification, purpose, and usage of their data. Data custodians are responsible for implementing the data classification, protection, and retention policies on the network. You should document the roles and responsibilities of each data owner and custodian, and ensure they have the necessary training and authority.

添加您的观点

4 Apply data labels and tags

The fourth step is to apply data labels and tags to your data based on the data categories. Data labels are visible markings that indicate the data classification, such as headers, footers, or watermarks. Data tags are metadata that enable the data to be identified, tracked, and controlled by network systems, such as encryption, access control, or auditing. You can use software tools or manual processes to label and tag your data.

添加您的观点

5 Enforce data protection and retention policies

The fifth step is to enforce data protection and retention policies on your network based on the data labels and tags. Data protection policies define how your data is secured, transmitted, and shared on your network, such as encryption, authentication, authorization, or VPN. Data retention policies define how long your data is stored, archived, or deleted on your network, such as backup, recovery, or disposal. You should monitor and audit your network activities and compliance regularly.

添加您的观点

6 Review and update your data classification policy

The sixth step is to review and update your data classification policy periodically or whenever there is a change in your business needs, regulations, or threats. You should evaluate the effectiveness and efficiency of your data classification policy, and identify any gaps, issues, or improvements. You should also communicate and educate your network users and stakeholders about the data classification policy and any changes.

添加您的观点

Shoumit Karnik

顾问 | Deloitte
举报内容
When the standard or framework which is the basis for the data classification policy undergoes updates, the policy for the organization should also be updated, to reflect the changes in data security posture.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Network Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you create a data classification policy that protects your network?

1

2

3

4

5

6

7

1 Identify your data sources

2 Define your data categories

3 Assign data owners and custodians

4 Apply data labels and tags

5 Enforce data protection and retention policies

6 Review and update your data classification policy

7 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

更多Network Security相关文章

更多相关阅读内容

How can you create a data classification policy that protects your network?

1

2

3

4

5

6

7

1 Identify your data sources

2 Define your data categories

3 Assign data owners and custodians

4 Apply data labels and tags

5 Enforce data protection and retention policies

6 Review and update your data classification policy

7 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

查看其他技能