Classification is just RBAC with history
Sep 4th, 2020 by Jesper Kråkhede
I have a theorem I have been pushing for many years. Information classification as we know it is an effect of security being expensive.
Think about where it comes from. Governments and the military classified information because protecting it cost money. Safes, guards, couriers, cleared staff, separate networks. You couldn´t afford to protect everything at the highest level, so you classified the information to know how much protection each document needed. The label told you how to handle it.
Interestingly, the UK government went from six classification levels down to three a few years ago, with the bulk of everything handled as ‘Official’ using normal commercial technology. As I read it, one big reason was exactly that the old model was too complex and too expensive to operate.
Now look at what we use classification for in companies today. Mostly to decide who should have access to what. But that is not really a classification question. That is a question of roles. The finance team should see the finance data, HR should see the HR data. That is Role Based Access Control, RBAC, and we have had the tools for it for a long time.
So my theorem is: Classification decides how strong the protection must be. RBAC decides who gets access. Mixing the two is why so many classification projects fail.
Keep them apart and both get a lot simpler.