Classification should change handling
A classification scheme is worth exactly as much as the difference it makes to behaviour.
If confidential and internal are stored the same way, shared the same way and kept for the same period, the labels are decoration. The test is whether you can say what specifically happens differently to something marked one way rather than another. Where that answer does not exist, simplify the scheme until it does.
More on Data security
- Tokenisation changes what systems need to holdHand over the ticket, not the coat
- Data lineage explains where sensitive data travelsFollow the dye
- Data residency is not automatic securityThe line goes round the building
- Retention is a security controlWhat you no longer hold
- Data access logs need object contextRead a record. Which one?
- DLP can match data patterns but cannot reliably infer the business purpose of a transferIt reads the shape, not the reason