IT Security Blog. Mitigating Risks. Enabling Business Strategies. W. Mark Brooks

Benefits of Data Classification

 

Data Classification has been around for many years.  As companies increasingly open their information networks to external collaborators, move to collaborative environments like SharePoint, and face increased legal exposure, Data Classification is increasingly being deployed as an effective means to help address risks and enable compliance.

  Quite often when the subject of Data Classification comes up, what comes to mind to most practitioners in information management is “You must classify all your information so that each piece of data that you use in the company is labeled – (e.g.  Red, Yellow, Green) based upon the sensitivity of the data.”  This of course feels like an overwhelming amount of effort and Data Classification falters due to fear of failure or because it becomes too difficult to gain approval for the business case. 

In most cases, this isn’t how Data Classification is implemented and often it isn’t how an organization gains the most benefit to Data Classification.  I believe that one of the greatest business benefits of having Data Classification implemented are realized when organization understands and focuses on Data Classification at a strategic level.  By strategic level, I mean at the Policy, People, and Governance level vs. the technology/tool level.

Here are what I see as the Top 5 Benefits of Implementing Data Classification at a strategic level:

· #5    The ability to make more effective management decisions on the level of controls necessary for data protection.  Having a Data Classification program in place that includes the appropriate levels of controls for the various classification levels, helps leadership make more effective investment decisions to meet internal and external control expectations.

· #4    The ability for the rationalization of controls by mapping control requirements to grouped “classes” of information vs. data element by data element.

· #3    The ability to use Data Classification as commonly accepted guidance across the enterprise for the controls that should be implemented to protect data, thus aligning resources and energy of the organization.

· #2    It can be used to reduce efforts and costs associated with controls of less sensitive data.  Often when Data Classification is developed, organizations come to the realization that they are not only UNDER controlling their most sensitive data, but they are wasting money and resources OVER controlling less sensitive data. (CISOs – Here is a great way to gain traction with your business partners by articulating cost savings and productivity gains via your Information Security initiatives!)

· #1  And the # 1 Strategic Benefit for Data Classification, is the Socialization of Data Governance concepts with the business enterprise.

 

Socialization of Data Governance?  If embarked upon from a truly enterprise and cross-functional perspective, Data Classification is also a great way to socialize data governance with senior leadership because the process and experience of defining the data classes and their expected controls is Data Governance.  Once this socialization process begins to gain traction, then organizations begin to realize a number of other strategic benefits.  These can range from:  stronger business sponsorship on specific IT investments to protect the information, better risk based decisions made by the organization, stronger ties of security requirements to business objectives, as well as decreased legal risks by being able to demonstrate due diligence through active leadership engagement in data governance.

Ironically, it is actually when these strategic benefits begin to be realized, that organizations can more effectively drive data classification into processes, procedures, and deploy technology solutions.  I say ironically, because most organization jump to finding a tool to classify data and then they find that once implemented, the organization resists adoption and data classification fails.  The resistance occurs because of lack of understanding, alignment, and buy-in to the need across the business.   Then organizations find themselves right back where they should have started – focusing on Data Classification at a strategic level or unfortunately altogether abandoning Data Classification.

Your comments and thoughts are welcome.

 

Mark Brooks

Why IT Security Organizations Often Fail with Strategy

 

 

I’m often asked why so many IT Security organizations lack an effective strategy and thought I would share with you some of the most frequent reasons I see this occur.

So here are my “Top 10 Reasons IT Security Organization Often Fail with Strategy”:

10.   IT Security leaders and often IT leaders will defer to the business to establish strategy and will view their role as implementing the business strategy.   However, in order to effectively implement the business strategy, IT Security needs its own strategy that is aligned to strategy of their business.

9.    Highly related to #10.   Developing an IT Security requires the IT Security organization and its leaders to fully understand and apply business strategies.   Frequently, security organizations find themselves too busy running their own operations to engage and learn about the business strategy.

8.    Developing business cases for investing in strategy development are difficult to develop and articulate.  Ironically, often these are the exact types of business cases that senior business leaders want IT and IT Security to be initiating.

7.   When a strategy business case is developed and approved, IT Security leaders have difficulty making progress on their strategies, because their day-to-day responsibilities keep them from being able to invest the required time in their strategies (See #9).

6.  Often leaders of IT Security Organizations have grown up as technical subject matter experts and have been promoted by their organizations for their technical knowledge or technology leadership.  As such, they simply focus their attention on areas that they have been rewarded to do so in the past – technology.

5.  The market offers many more technology solutions to IT Security leaders and organizations than it does sets of capabilities to help them develop strategies.  When I was responsible for enterprise risk, security, and compliance in a Fortune 500 company, I very seldom had vendors calling on me to assist me in developing and implementing strategies.  Most of the time, they called on me to sell hardware and software products (Driven also by #6).

4.   Thought leaders, industry groups, and solutions providers haven’t effectively communicated the value and importance of security strategy as compared to the value proposition of available technology solutions.

3.  Truly effective IT security strategies require the full engagement of lines of business and IT Security is unable to marshal the necessary business sponsorship and resources to partner with them on their strategy.   This also results in many IT Security Strategies morphing solely into technology strategies.

2.  Strategies are not as tangible as other interventions, in particular technology solutions.  Their value and return on investment require qualitative measures in addition to quantitative measures to determine their success.   Qualitative measures are often more difficult to define and measure, than quantitative measures.

1.   And the #1 reason why many IT Security organizations fail to have an effective strategy?  They are complex, cross-functional, and often span months to years in their development and implementation.   In other words, it’s hard work.   IT Security is like any other organization in IT or the business.  It is easier to embrace short-term solutions and their incremental gains than taking the long-term view.