Confidentiality

What confidentiality is

Confidentiality just means the state of being kept secret or private. We have data that could cause damage to the company if it were to be released, and so we need to keep certain data safe and secure.

Risk

Of course, data has a real value to it, so there are going to be people out there that are going to want to access that data or steal that data. Depending on what that data is, we could have a loss of revenue, a loss of assets, a loss of some sort of judgments and fines. We could have the cost of mitigating that. We could have loss of competitive advantage, loss of reputation, loss of customers, loss of business. There are a lot of things that can happen if we lose customers' data or other types of data.

There are lots of different types of data that could be stolen. Things like trade secrets — a special way that we deliver our product, or a special ingredient to our recipe. There could be some sort of intellectual property, things that we know that others don't that give us a competitive advantage. There could be financial information, like credit card numbers. There's information that's regulated or has some sort of legal backing to it. There's human readable and non-readable data. And there's information that's called personal information, or personally identifiable information.

PI versus PII

It's important to understand the difference between PI and PII. PI is personal information, information that's personal to us, versus personally identifiable information, which is a type of PI which actually identifies us.

Personal information would be things like medical records or school records or financial records, things that are personal to us that we wouldn't want out. As a company, we have to keep our customers' personal information very secure.

Then there's personally identifiable information, which is almost a next level up: things that identify a specific person. That would be things like Social Security numbers, or names and addresses, or things that we can zero down on a single person. That would be information that would fall under PII information.

PI information, or personal information, could also be called personal data when you're talking about things like GDPR. Countries like Europe will use the term personal data.

Data sovereignty

That brings us to our next point of data sovereignty. How we treat data is going to depend on where that data is originating from. What I mean by that is that I'm actually in the States, in the United States, and if I have customers that are in Europe, I actually have to treat that data differently, according to Europe's laws and regulations. So data sovereignty is the different geographical locations of where that data originates from and how I need to treat that data.

Data classifications

It also matters what type of data it is — that will determine how I need to treat that data.

There are things that are public data, things that I release out to the public that pose no risk or no harm to the company at all, and then I would define how I'm going to handle that as a company. There would be certain ways that we would handle that as a company, or certain regulated ways that we have to handle it. Public information would be like our website information; we actually kind of want that to get out there.

There's internal information, really things that have low impact and would maybe just lead to a little bit of inconvenience if it got out, but it's not that big of a deal, and so those things we keep behind a locked door, and we have a different set of instructions on how we handle that data.

Then we have confidential information. This is the stuff that could lead to some critical losses if it gets out, so we are going to start protecting that data to a larger degree. We're not going to just give control access to it, but maybe we actually do some encryption of it, or keep it at a safer level.

And then there's restricted data. This is the high risk level: if it were to get out it could cause devastating consequences to the company, and we're going to have the most strict handling measures around this restricted data.

This is a common structure that's used for business, labeling it as public, internal, confidential or restricted, but there are some other classifications that you may see out there — sensitive, private or critical. Just realize that there are different levels of these.

Implementation methods

What are some methods of protecting this data? The ideal way, or at least the most secure way, is just to get rid of it — not to have that data to begin with. Of course, data has some value to it, so this isn't the answer for everything, but if we can, let's just get rid of it.

Then there's also this idea that we could protect the data, that we could lock it behind some sort of closed gate. That's where the AAA service comes in — authentication, authorization and accounting. We do some segmentation, we do some permission restrictions, we maybe do some geographical restrictions. So we put restrictions on this data, on who has access to it.

The other thing we can do is hide the data, or maybe do something like encrypting the data. So we can hide it, we can block the access to it, or get rid of it entirely.

Here are some ways to hide our data. For one, we can encrypt the data, that is, we can change the data into some sort of secret code. We can use steganography, which means that we're going to hide the data in something else, like maybe a picture. We could do data masking, where we are going to replace the data with some sort of other data. Or obfuscation, where we are going to make the data confusing or unintelligible.

The value of data

Ideally we could just get rid of this data and it will not be an issue at all, but data has a value to it. Companies label things as either assets or liabilities. Assets are things that bring value to the company, that add to the revenue, that help make good decisions to be able to bring in more money. Liabilities are things that the company owes, or responsibilities that the company has. We can label everything within a company as either an asset or a liability.

What happens is that there are a lot of people that put a high value on our data, that it's a tremendous asset — and for a good reason, it helps us make good decisions. So execs and the board of directors and the marketing department and sales and finance are all going to want more data, because that data helps make great decisions. An example of that is if we have a lot of rich customer data that has some great information with it, then we can make better decisions to bring in more revenue, so we can market to people better.

But the problem is that there's also this oversight, not seeing that there's actually a liability side to this data as well. If you have a bunch of customer data, and that's sensitive data, and it gets leaked out, that could be bad — especially if it was old customer records, of customers who aren't customers anymore, and it gets leaked out. Then there really wasn't a reason for us to be holding onto that data, and that could cause huge problems.

Part of this is going to be a discussion that happens amongst the people who want this data, who see all the value in the data, and the cyber security people who are leading the cyber security efforts, who see that this data could be a liability. There's a communication that needs to happen to really truly assess what is the asset value versus the liability side of this data, to make accurate decisions on whether you keep the data or not.