Information Classification: Information Stewardship in Practice

Transcription

1 KuppingerCole WHITEPAPER by Martin Kuppinger April 2013 Information Classification: Information Stewardship in Practice How classifying information helps improve Information Security. Finding the right mix of tools and manual interaction. Making Information Classification work. by Martin Kuppinger April 2013

2 Content 1 Executive Summary Research Highlights Information Stewardship: Assigning Accountability to Users Information Classification: Automation and Interaction Summary and Recommendations Copyright... 8 Content Figures Figure 1: Elements of Information Stewardship Related Research Whitepaper: Using Information Stewardship within Government to Protect PII February 25, 2013 Advisory Note: From Data Leakage Prevention (DLP) to Information Stewardship November 30, 2012 Vendor Report: TITUS October 25, 2011 Page 2 of 9

3 1 Executive Summary Information Stewardship uses good governance techniques to implement information centric security for all of your data. Information Stewardship involves the business as well as the IT services group. It creates a culture where the people in the organization understand the sensitivity of information and the ways in which this information can be put at risk. A key concept within Information Stewardship is that it creates a culture where the people in the organization understand the sensitivity of information. Such culture in consequence means that people feel responsible and even accountable for information. Information Stewardship is a concept that involves a variety of elements. Amongst these elements are security principles, technical solutions, and processes. Amongst these processes is Information Classification, which needs to be supported by adequate tools. Information Classification is a system for actionable approaches to Information Security. As long as information is not classified, organizations cannot focus activities and investments. Trying to protect any and all information the same way is both inefficient and impractical. Classification is what allows companies to focus on the really sensitive and valuable information. Classification done right needs to: work with a well-thought combination of manual involvement of users and automation, as needed be sufficiently fine-grain to result in various attributes that can be used for managing security and access work on various levels, both back-end and front-end and with various layers; it might start with classifying file types at backend systems and allow for detailed classification when editing Microsoft Word documents or sending s focus on information, not on systems The latter is probably the most important point. When business looks at IT, i.e. Information Technology, business cares about the I and not the T. Clearly, any approach to classification that involves users imposes the challenge of getting the users to do their job. That is where the concept of Information Stewardship becomes so important: it is about educating users about the why, as one part of designing and implementing Information Stewardship. Once that culture where the people in the organization understand the sensitivity of information is in place, classification will work far smoother than when just introducing a technical tool that is considered a burden for daily work by the users. Page 3 of 9

4 2 Research Highlights Defines the concept of Information Stewardship Shows why Information Stewardship is the foundation for users becoming responsible for information and for assigning accountability Explains the role of classification for Information Stewardship Defines dimensions for classification solutions Lists what needs to be in place for classification to be done right 3 Information Stewardship : Assigning Accountability to Users Information Stewardship uses good governance techniques to implement information centric security for all of your data. Information Stewardship involves the business as well as the IT services group. Line of business managers, application owners and everyone who touches information are involved, as well as the IT service providers. It creates a culture where the people in the organization understand the sensitivity of information and the ways in which this information can be put at risk. It applies best practices and uses the most appropriate technologies to protect information. It makes sure that the organization is resilient to loss of data by protecting information against that eventuality. And when the seemingly inevitable leakage/loss occurs, information Stewardship provides the resilience necessary to mitigate the damage and restore both the information as well as the trust of users. Information Stewardship is a key component of IT governance, and IT governance ensures that the IT services however they are delivered - provide appropriate levels of security for that information. The continuing problem of data leakage, data loss and data theft show that information governance, in itself, has proven inadequate to prevent these issues. Since many of the large organizations that have suffered these problems are both technically sophisticated and well aware of the value of the information lost, it would seem that information governance as currently implemented by these organizations is not sufficient. Information Stewardship consists of a set of policies, procedures, practices and organizational structures that, taken together, are aimed at ensuring the management of information according to defined strategies and controls. The objective of information governance is to meet business needs, manage risk and ensure compliance with laws and regulations. Information Governance is also concerned with creating a culture within the organization and it is this aspect that has been lacking. In addition organizations need to implement stronger controls on access to their data and take measures to protect against external threats. Page 4 of 9

5 A key concept within Information Stewardship and Information Governance as part of this concept is what has been mentioned as creates a culture where the people in the organization understand the sensitivity of information. Such culture in consequence means that people feel responsible and even accountable for information. Someone who understands the sensitivity of information and the value of information will feel responsible for that information. Creating such a culture means also creating a culture of responsibility. However, it is not only about the culture. It is also about clear guidelines that define responsibilities and accountabilities. While every users needs to understand his responsibility for acting accordingly as an Information Steward of the corporate information he creates and uses, accountability has to be well planned and defined. Common concepts assign accountability to the information creator or information owner. Overall, the latter appears to be the better concept. It allows assigning ownership for sets of information such as specific types of legal contracts to defined persons such as the manager of the legal department. Clearly defining responsibilities and accountabilities for information is a key element of Information Stewardship. 4 Information Classification: Automation and Interaction Information Stewardship is a concept that involves a variety of elements. Amongst these elements are security principles, technical solutions, and processes. The latter must be supported be adequate tools. Amongst these processes is Information Classification, as shown in Figure 1. Security Processes Elements Confidentiality Integrity Availability Information Classification Access Policies and Controls Auditing Identity Management Access Management Secure Storage Flow Control Monitoring and review Figure 1: Elements of Information Stewardship. Page 5 of 9

6 Information Classification is a system for actionable approaches to Information Security. As long as information is not classified, organizations cannot focus activities and investments. Trying to protect any and all information the same way is both inefficient and impractical. Classification is what allows focusing on the really sensitive and valuable information. While some information is publicly available, the visibility of some other information must be restricted to just a few people. Some classes of information such as PII (Personally Identifiable Information) must be handled more careful by default, due to legal restrictions. The increasing relevance of classification becomes obvious when looking at Microsoft Windows Server 2008 and Both support the File Classification Infrastructure (FCI) that provides a standard interface for attaching classification information to any file. Windows Server 2012 then is able to enforce access policies based on these classifiers by using its DAC (Dynamic Access Control) technology. This is a perfect example for the relevance of classification: Access is granted based on the classification. However, before managing access based on classification, it is necessary to know about classifying information. When looking at classification, approaches can be classified based on four dimensions: Automation: Automated; semi-automated (with some optional user involvement); manual Granularity: Coarse-grain (such as classified, confidential, ); fine-grain with a mix of classification, sensitivity, and other attributes that control classification System: Front-end vs. back-end; Mail, File Server, Office Applications, Target: System; Information Today, most organizations either pass on classification (not to say: ignore the need of classification) or rely on coarse-grain approaches. For instance in Germany, a common concept is the Schutzbedarfsanalyse, the analysis of data protection requirements. This concept, defined by the BSI (Bundesamt für Sicherheit in der Informationstechnik, the Federal Agency for IT Security), is a fairly rough one. It looks at systems instead of information and works with a coarse-grain approach regarding the security or risk levels. Doing so frequently results in a large number of high-risk systems. Protecting them all the same way frequently is costly or even impractical, especially given the fact that large amounts of information held at these systems can be at lower risk. It s also true that this is a purely manual approach. Classification done right needs to: work with a well-thought combination of manual involvement of users and automation, as needed be sufficiently fine-grain to result in various attributes that can be used for managing security and access Page 6 of 9

7 work on various levels, both back-end and front-end and with various layers; it might start with classifying file types at backend systems and allow for detailed classification when editing Microsoft Word documents or sending s focus on information, not on systems The latter is probably the most important point. When business looks at IT, i.e. Information Technology, business cares about the I and not the T. Business is not interested in the systems (and thus technology) but in the information. There is a good reason why we talk about Information Stewardship and Information Governance rather than Technology Stewardship and Technology Governance. Clearly, any approach to classification that involves users poses the challenge of getting the users to do their job. That is where the concept of Information Stewardship becomes so important: It is about educating users about the why, as one part of designing and implementing Information Stewardship. Once that culture where the people in the organization understand the sensitivity of information is in place, classification will work far smoother than when just introducing a technical tool that is considered a burden for daily work by the users. Classification Technology: The TITUS solution When looking for Information Classification technology, TITUS comes into focus. With their various solutions for classification the vendor provides a set of options for customers. The product range consists of four different products: Message Classification, with tight integration into Microsoft Outlook (including the Outlook Web App) and IBM Lotus Notes, for user-driven classification of mails and enforcement of policies based on the classification Classification for Microsoft Office, for user-driven classification of Microsoft Office documents, again with policy enforcement on the desktop Classification for Desktop, a solution that allows for coarse-grain classification based on file types at the desktop File Server Classification, a back-end solution that enables classification together with the Windows Server FCI (File Classification Infrastructure) TITUS provides both front-end and back-end solutions with support for various systems and the most important sources of information that is created individually, i.e. s and Office documents. TITUS also provides a good mix of manual and automated classification, with advanced technologies analyzing and highlighting the sensitivity of mails and documents while allowing the user to make his choice and thus take his responsibility with as little involvement as feasible. Page 7 of 9

8 5 Summary and Recommendations Information Stewardship is what organizations must implement in these days of increased cyber-attacks and information risks. A key process within Information Stewardship is Information Classification. Information Classification done right allows to focus on the high-risk, sensitive and valuable information and to focus investments. Making Information Classification work requires a good understanding by users of the need to classify information. This is about creating a culture where people understand the sensitivity of information and the need to act responsibly. It is about assigning responsibility and accountability for information security and, as part of that, classification. Implementing Information Classification is a must for organizations. However, that needs to be done right. Most organizations today struggle with that task. However, both the concepts for Information Stewardship and thus the organizational framework and the technologies for Information Classification are available today. We strongly recommend that organizations focus on Information Stewardship and, within that concept, implement flexible, multi-layered approaches for Information classification. Doing this is a major step on increasing Information Security. 6 Copyright 2013 Kuppinger Cole Ltd. All rights reserved. Reproduction and distribution of this publication in any form is forbidden unless prior written permission. KuppingerCole disclaim all warranties as to the adequacy, accuracy or to the completeness of information contained in this document. Even if KuppingerCole research documents may discuss legal issues related to information security and technology, KuppingerCole do not provide any legal services or advice and its publications shall not be used as such. KuppingerCole shall have no liability for errors or inadequacies in the information contained in this document. Any opinion expressed may be subject to change without notice. Page 8 of 9

9 The Future of Information Security Today KuppingerCole supports IT professionals with outstanding expertise in defining IT strategies and in relevant decision making processes. As a leading analyst company KuppingerCole provides first-hand vendor-neutral information. Our services allow you to feel comfortable and secure in taking decisions essential to your business. KuppingerCole, founded in 2004, is a leading Europe-based analyst company for identity focused information security, both in classical and in cloud environments. KuppingerCole stands for expertise, thought leadership, and a vendor-neutral view on these information security market segments, covering all relevant aspects like Identity and Access Management (IAM), Governance, Risk Management and Compliance (GRC), IT Risk Management, Authentication and Authorization, Single Sign-On, Federation, User Centric Identity Management, eid cards, Cloud Security and Management, and Virtualization. For further information, please contact clients@kuppingercole.com Kuppinger Cole Ltd. Am Schloßpark Wiesbaden Germany Phone +49 (211) Fax +49 (211)