Data Classification Why, When and How

Transcription

1 Data Classification Why, When and How Primary Author: Steve Duplessie, Senior Analyst, Secondary Author: Heidi Biggar, Analyst, October 2005

2 Executive Summary Executive Summary Data classification has become one of the hottest topics of Unfortunately, the buzz around it has also created a lot of confusion about what it is and what it isn t. At a fundamental level, data classification is the process of characterizing different data types, structures, and values so that organizations can begin to reap the greatest business benefit out of the data they have. Data classification is not the end but rather the beginning of a process that ultimately helps bridge the gap between IT deliverables and business services. And data classification allows organizations to leverage infrastructure for ultimate effect, getting real value back from information life-cycle management (ILM) strategies. Once data has been appropriately classified, or categorized, it is moved to the appropriate level of infrastructure at the appropriate time in order to maximize IT s ability to deliver an exact business value at an exact cost. Doing this eliminates the variable unknown costs of service that have plagued IT for years. In short, data classification is the keystone to building an intelligent IT service bureau within your organization without which organizations are shooting blind. The Business of IT The Problem Delivering Value to the Business IT is most often considered a cost center, and rarely a profit center. Why? Because it has rarely been able to deliver exact service levels at exact cost points. Too many variables have skewed both sides of the equation. When the costs are known, service levels vary, and vice versa. In order to move from a cost center to a profit center, IT needs to reformulate the process of how it does business. The challenge for organizations is figuring out how to move from the chaotic world in which they currently live to a structured world in which outcome and income are entities. And they need to do this without disrupting business along the way. The key is to restructure IT in such a fashion that it is thought of and behaves as a business within a business. Once that happens, IT will get all the money it needs. The plain, hard truth is that an organization will invest $1 if and only if it knows it will reap $1.10 in return. So, until IT can be a real business, it will be treated as a second-class citizen within the organization. Data classification is the first step in this process of turning IT into a full-fledged business unit or entity. What Classes of Service Is IT Expected to Deliver? In basic terms, IT is expected to make sure data (or information) is available, protected, in compliance with regulatory or corporate governance policies, and extractable : 1. Availability IT must ensure that data is available to business lines (via applications) at all times and that it meets pre-defined performance levels. 2. Information Protection and Security IT must protect data from unauthorized access and tampering, and secure it from corruption and theft. 3. Supporting Compliance and Enforcing Corporate Governance IT must meet all regulatory requirements and general corporate governance requirements and must actively monitor the environment and be able to take instant action when breaches are detected. 4. Enhancing the value of information IT needs to make information live so that organizations may derive value from it beyond its original intention. Keeping information in a form that is accessible and open to future application uses is critical for extracting value beyond original usage requirements. Page 1

3 The Challenges The challenges are so many that it is impossible to list them all. The core issues revolve around data growth. IT is contending with boundless data growth of various data types: structured, semi-structured, and unstructured data. While these data types are all independent, they are also interrelated. These dependencies create enormous problems for IT environments, especially as they try to provide holistic information, not just stovepipe elemental, value. But the more data that is out there, the more tools, people, and equipment that needs to be housed, protected, and delivered. And that means more security risks. Security is an enormous problem now but will grow exponentially going forward. The answer for IT is not to hold back, or harness, the information but to recognize the need to rethink the processes and procedures that are in place to deal with this growth. How Do We Deliver an IT Service Bureau to the Business? The first step in turning IT into a true business unit is giving it a service-oriented architecture. To do this, IT has to be able to discover data and classify it. Once that is achieved, IT can then make rational, intelligent decisions about how to treat the various classes of information, or data, in their environment. The problem is that IT has traditionally treated all data equally. But not all data is created equal; it has varying importance to organizations and therefore should be treated according to its underlying value. So, rather than throwing technology or capacity at a problem, IT needs to begin classifying its organization s data. Only after IT has successfully classified its data can it begin to maximize the infrastructural economics of being able to deliver information to those who need it, when they need it. Data classification (and, similarly, ILM) helps IT put its objectives in a service-level mindset. Data classification, not technology, has the potential to turn IT into a profit center. Technology plays a role down the road after data assets have been classified and service levels applied. Technology ultimately manifests itself as the physical bridge between IT and business. In short, technology rarely solves the problem it just moves it: Improve CPU performance and you may just find yourself with an I/O problem, etc. However, technology that is applied to an identified process with known service-level requirements can ultimately solve problems. Data classification is the means to this end. What Is Data Classification? Data classification is all about knowing what data exists, how to treat it (e.g., what data to keep, what data to get rid of, and where to keep it), and effectively communicating that information back to the lines of business. Data classification is a means not only to define what s important and what isn t, as well as determining the different treatment of information, but it is also the framework for IT and business to agree on service levels and formalize them in policy. In short, data classification: Is the process of grouping data into actionable, logical categories. Groups data with similar information attributes into logical classes, removing the complexity of describing each data item individually. Makes it possible to abstract a service model based on classes of service requirements. Similar attributes can be synonymous with service requirements (e.g., uptime or availability, retention period for compliance, or access for security purposes). Helps business and IT identify important versus secondary information by identifying what information needs higher levels of service, including security, protection, etc. Page 2

4 Is not a one-time event but a living, or fluid, process. Data values and characteristics change over time. Challenges to Beginning the Process While it is possible to create a data classification process internally, it is not recommended. The process can be overwhelming. To ease the process and save countless time, energy, money, and not to mention sanity organizations should consider enlisting outside help from service organizations with practices in these areas. Having a strong partner to help you navigate through this process is like having a professional caddy at Pebble Beach it will save you from yourself! Data Classification and ILM While the point of data classification is to group data into logical classes that drive business service models, ILM has a broader philosophy. ILM can be considered the part of the process whereby classified service requirements live on semi-permanent infrastructure islands to provide the overall service level to the business. The ILM islands change from time to time based on the cost versus service-level deliverable trade-off. Today, most so-called ILM implementations are nothing more than tiered storage; little thought has gone into what goes where and why. Data grooming exercises that move data off and onto storage assets based on some rudimentary criteria such as age are good first steps, but they have no lingering effects since they are static and must be repeated. However, ILM strategies that are built on top of data classification foundations can lead to a tangible business service-level model, which yields a technical specification that, in turn, can lead to a technical architecture to deliver the service model. Applications can be migrated to more effective and efficient architectural tiers in a trade-off of cost versus service delivery. This is the crux of what the talk about data classification is all about. This is how IT delivers consistent business value. Understanding Enterprise Data and Its Challenges There are three basic types of enterprise data: structured, semi-structured, and unstructured. To decide what kind of data classification strategy to use, it is important to understand their differences and associated classification challenges. A data classification strategy must be tuned to the characteristics of the data types. Structured data is best thought of in terms of databases and applications that leverage databases. This type of data is relatively known and understood. It is fairly straightforward to tackle structured data and achieve very large cost savings through tiering of architecture and SLAs, using applications as an organizing principle. Database grooming tools can be effective in streamlining core database operations while maintaining structured semantics and off-loading some components of the database to other non-structured storage mediums. There are schools of thought that suggest that everything belongs in a database for search reasons, but this is impractical from a financial and management perspective. The cost associated with keeping everything at the top of the ILM pyramid is counter-intuitive to the results sought. Semi-structured data (e.g., ) has some kind of hierarchy and relational characteristics but is still fairly freeform and its proliferation is not easy to forecast. The business world has recently recognized that this class of information is mission-critical. This category of data requires organizations to formulate policy and defense against compliance demands and litigation, which means companies are expected to identify, isolate, and quarantine groups of information for court and evidentiary purposes. It also requires organizations to set policies for garbage s. Worse yet, the interaction of semi-structured, unstructured, and structured data, with all of the Page 3

5 dependencies, make regulatory compliance in such a discovery almost impossible as a single task. Classifying data by like group requirements can mean the difference between finding a co-dependency among different data types and finding nothing at all. With semi-structured data (i.e., ), organizations know the class of information with which they are dealing. What they must determine are the policies for treating that information (i.e., how long they will retain the information and what rules will apply to the three types of information end-user). This is an opportunity for the line of business to liaise with IT, and an opportunity for IT to liaise with stakeholders for compliance and support (usually the CFO or office of general counsel). This is an emerging area for IT to demonstrate its ability to help drive corporate information policy and automate that policy through emerging archive technologies. Unstructured data includes file systems and what is found in file systems (e.g., individual documents) as well as a whole new class of content proliferated by new digital systems such as PDAs, ipods, and mobile voice mail. Of the three types of data, the unstructured category is growing fastest. Whether this is mission-critical or not is yet to be determined. With unstructured data, the challenge is to build a taxonomy of the types of information and content as well as their relative importance to and use during business processes. Here, classification includes business processes (e.g., what processes are mission-critical or business-important and support higherlevel processes), the applications that support these processes, and the infrastructure that supports these applications. Against that hierarchy, or set of relationships of process to IT, an information taxonomy is built that identifies what information is important and at what time in the overall business process. Conclusion Continuing to hide your head in the sand and perpetuating the just buy more hardware attitudes of the past no longer work. The value of providing true services to the business is not just recognized by IT but by the business itself. Data classification enables business line managers to pick services from a menu of IT offerings with the knowledge that IT can and will deliver exactly the SLA offered and at an exact cost to the business. At that point, the decision moves from the IT staff to the business line managers, and regardless of the choices, IT becomes a profit center and as such, dramatically increases its value inside the organization at every level. Many of these concepts sound fundamental, and they are. But they have not been put into practice for a variety of reasons (e.g., complexity, costs, and fundamentally, a lack of understanding of the desired outcome). Empowering the business unit is the goal, and IT is the tool to do that. Building IT (or re-building IT) from the ground up to meet this goal makes data classification the necessary first step in the process. From there, IT can work with the business to understand overall requirements by class and build the technical model required to make it all work. All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The, Inc. and is intended only for use by Subscribers or by persons who have purchased it directly from ESG. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of the, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at (508) Page 4