3.3 Protect data
📘CompTIA Security+ (SY0-701)
Data classification is the process of organizing data based on its sensitivity, importance, and the impact to the organization if it’s disclosed, altered, or destroyed. It helps IT teams decide how to protect information, who can access it, and what security measures to apply.
Classifying data correctly is crucial for protecting organizational information, meeting compliance requirements, and reducing security risks.
1. Sensitive Data
- Definition: Data that is not meant for general use and could harm the organization or individuals if disclosed.
- Access: Limited to specific roles or teams who need it for their job.
- Impact if exposed: Moderate damage, such as financial loss or minor reputation harm.
- IT Examples:
- Internal project plans
- Employee schedules
- Internal technical documentation
- Protection: Encryption in storage and during transmission, strong access control, monitoring access logs.
2. Confidential Data
- Definition: Data that is highly protected because disclosure could seriously affect the organization.
- Access: Only accessible to people with explicit permission (often top-level management or specific departments).
- Impact if exposed: Severe consequences, such as major financial loss, regulatory penalties, or competitive disadvantage.
- IT Examples:
- Customer financial information (credit card numbers, banking info)
- Business strategies or upcoming product plans
- Source code for proprietary software
- Protection: Strong encryption, multi-factor authentication (MFA), strict need-to-know policies, and data loss prevention (DLP) tools.
3. Public Data
- Definition: Data that can be shared freely without harm.
- Access: No restrictions; anyone can access it.
- Impact if exposed: Minimal or no impact.
- IT Examples:
- Press releases
- Marketing brochures
- Public website content
- Protection: Basic integrity checks (to prevent tampering) and availability measures, but confidentiality is not a concern.
4. Restricted Data
- Definition: Data that has very limited access due to legal, regulatory, or organizational reasons.
- Access: Only specific individuals with explicit permission can access it. Often higher security than confidential data.
- Impact if exposed: Regulatory fines, legal consequences, or major organizational damage.
- IT Examples:
- Medical records (HIPAA compliance)
- Employee health information
- Legal contracts under NDA
- Protection: Strong encryption, strict auditing, role-based access control (RBAC), monitoring, and compliance checks.
5. Private Data
- Definition: Data that relates to individuals and their personal information.
- Access: Only the owner of the data and authorized personnel can access it.
- Impact if exposed: Identity theft, privacy violations, or personal harm.
- IT Examples:
- Personal email accounts
- Login credentials
- Employee or customer personally identifiable information (PII)
- Protection: Encryption, anonymization when possible, MFA, and secure storage.
6. Critical Data
- Definition: Data essential for the organization’s core operations. Loss or corruption could stop business operations.
- Access: Highly controlled; only authorized staff can modify or access it.
- Impact if exposed: Business downtime, financial loss, operational disruption.
- IT Examples:
- Database of current transactions
- Active system configurations
- Cloud service backup of operational data
- Protection: Regular backups, disaster recovery plans, high availability systems, redundancy, encryption, and monitoring.
Why Data Classification Matters for Security+ Exam
- Controls depend on classification:
Security measures like encryption, access control, and auditing are applied according to the classification. - Compliance:
Organizations must comply with laws (HIPAA, GDPR, SOX) that require data classification. - Risk management:
Helps prioritize protection for the most sensitive or critical data.
Key Exam Tips:
- Remember the impact hierarchy: Public < Sensitive < Private < Confidential < Restricted < Critical.
- Access control is always tighter as sensitivity increases.
- Encryption is almost always required for Confidential, Restricted, Private, and Critical data.
- Monitoring and auditing are more important for sensitive and critical data.
