Classifying Data

You cannot protect what you never bothered to find. Classification is the map.

16 mindata-classificationpiidiscoverygovernancelabeling

What you will learn

-Sort data into tiers by the damage a leak would cause
-Find where sensitive data actually lives, not where you assume it lives
-Attach handling rules to a label so protection becomes automatic

A public makes the news, and the first question from legal is the one nobody can answer: what was in it. Not "was it sensitive" in the abstract, the actual records. If you never classified the data, you are now paying a forensics firm to read three terabytes of to work out whether you have to notify 200,000 people. Classification is doing that work up front, cheaply, before it is an .

Classification means sorting data by how much it hurts you when it leaks. That is the whole question. Everything downstream keys off the answer: which , which access , how long you keep it, whether a leak is legally reportable.

Most orgs land on four tiers. Public, internal, confidential, restricted. Public is the marketing site. Internal is the org chart, annoying if it leaks but not a lawsuit. Confidential is customer PII, contracts, source code. Restricted is the stuff that ends careers: payment card data, health records, , anything with its own regulator. Fewer than four tiers ignored. More than four get argued about in meetings. Four is the number that survives contact with real people.

The label is worthless unless it drags handling rules behind it. "Restricted" has to mean something mechanical: encrypted at and in transit, access logged, required, no copies to laptops, destroy after the retention window. If the label does not change where the data lives and who can touch it, you built a color-coded spreadsheet, not a control.

Find it, do not guess

Here is the part everyone skips. You do not know where your sensitive data is. It is in a forgotten reporting database, in Slack DMs, in a CSV an analyst emailed themselves in 2021, in application that dump full request bodies at debug level. The data map in the wiki is fiction within a quarter of being written.

So run discovery. Point a scanner at your stores and let it pattern-match for Social Security numbers, Luhn-valid card numbers, and email addresses. The output is always uncomfortable, and that discomfort is the point.

crude to managed discovery

# one-line SSN sweep of a file share, zero budget

$grep -rEl '[0-9]{3}-[0-9]{2}-[0-9]{4}' /mnt/share

# managed PII discovery across S3 buckets

$aws macie2 create-classification-job --s3-job-definition ...

# NER-based detection that catches names and addresses regex misses

$presidio-analyzer --language en < export.txt

Discovery reads the real records

A classifier has to open and read actual sensitive data to label it. Run Macie, Purview, Presidio, or even a grep sweep only against systems you own or have written to assess. Pointing a discovery job at a 's production database without is unauthorized access to the exact data you were hired to protect. In a lab, seed a throwaway database with synthetic PII from a generator like Faker and practice on that.

The label has to travel

Data moves, and the label has to move with it. A restricted record pasted into a Confluence page does not become "internal" because it changed buildings. Classification that tags data at creation and keeps the tag attached is what lets DLP and access controls act on it wherever it lands. That is why file-level sensitivity labels, the kind Microsoft Information Protection stamps into the document itself, beat folder-level rules that a single copy-paste defeats.

When someone asks why classification matters before encryption, this is the answer. Encryption, access control, retention, and breach reporting all take the label as their input. Skip classification and every other control is guessing.

Where do raw credit card numbers stored for recurring billing belong in a four-tier scheme?

Encryption at Rest and in Transit