Following my last post, a word to management about the cost of information classification.<\/p>\n
I have seen several classification projects that ran for years, produced impressive documents with five or six levels and a matrix of handling rules, and then never got used. The users didn\u00b4t understand the difference between level three and four, so they marked everything as Internal and moved on. Money spent, nothing protected.<\/p>\n
The reason is usually that the project tries to solve two things at once: how strongly to protect the information and who should have access to it. The first is a security question with a handful of answers. The second is a business question about roles and responsibilities, and it changes every time someone gets a new job.<\/p>\n
So my advice. Keep the classification simple, three or four levels at most, and connect each level to a technical protection, like I wrote in August. Let the business own the roles and let IT implement them as groups and permissions. And review the roles once a year, not the classification.<\/p>\n
It will cost less, the users will understand it and, most importantly, it will actually be used.<\/p>\n
The best classification model is the one your users can remember.<\/p>\n","protected":false},"excerpt":{"rendered":"
Following my last post, a word to management about the cost of information classification. I have seen several classification projects that ran for years, produced impressive documents with five or six levels and a matrix of handling rules, and then never got used. The users didn\u00b4t understand the difference between level three and four, so […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,70,73],"class_list":["post-1220","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-cost","tag-information-classification"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1220"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1220\/revisions"}],"predecessor-version":[{"id":1248,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1220\/revisions\/1248"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}