Data and Asset Classification: Not All Information Is Created Equal
Picture an office building. The lobby is open to anyone, the staff areas need a badge, and the vault in the basement needs a badge, a second approval, and a signed agreement. Nobody would guard the lobby the way they guard the vault, because the cost of losing what’s inside is completely different.
Security professionals think about data the same way. Protecting an organization’s operations and assets from threats, risks, and vulnerabilities is the whole job, but you can’t protect everything equally. You need to know what matters most. That’s what data classification is for.
The four data types
Most organizations sort data into four categories, from least to most protected.
Public data
This is information that’s already accessible to the public and poses minimal risk if someone views or shares it. Examples include press releases, job descriptions, and marketing materials.
“Public” doesn’t mean “unprotected.” Basic security measures still apply, because attackers could still tamper with it, such as defacing a web page.
Private data
Private data should be kept from the public. If someone gains unauthorized access, it could pose a serious risk to the organization. Examples include company email addresses, employee identification numbers, and an organization’s research data.
Sensitive data
Sensitive data must be protected from everyone who doesn’t have authorized access. A leak can seriously damage an organization’s finances and reputation. This category includes:
- PII: personally identifiable information
- SPII: sensitive personally identifiable information
- PHI: protected health information
Examples are bank account numbers, usernames and passwords, Social Security numbers, passport numbers, and medical information.
Confidential data
Confidential data is vital to an organization’s ongoing business operations. Access is often limited to a small number of people, and may even require signing a non-disclosure agreement (NDA), a legal contract that binds parties to protect the information. Examples include trade secrets, financial records, and sensitive government data.
| Type | Risk if exposed | Examples |
|---|---|---|
| Public | Minimal | Press releases, job descriptions, marketing materials |
| Private | Serious | Company emails, employee ID numbers, research data |
| Sensitive | Significant financial and reputation damage | PII, SPII, PHI, passwords, bank accounts |
| Confidential | Threatens ongoing business operations | Trade secrets, financial records, sensitive government data |
Asset classification: low-level to high-level
Asset classification means labeling assets based on how sensitive and important they are to the organization. Assets range from low-level to high-level:
- Low-level assets: Public data falls here. It’s readily available, and the organization won’t suffer if it’s compromised. A company’s website address is a good example.
- High-level assets: Sensitive and confidential data fall here. If leaked, they can cost a company its competitive edge, reputation, and customer trust. An internal email discussing trade secrets is a good example.
Notice that the label depends on the impact of a compromise, not on how “technical” the data looks.
Why this matters to you
Classification tells you where to spend your attention. It helps you:
- Prioritize which data needs the most protection
- Recognize which assets need higher levels of security and which need only minimal security
Every company has its own data classification policy that spells out what falls into each category. Part of your job as a new security professional is to learn that policy early.
See what happens when classification breaks down in my Data Leak Analysis project.
Key takeaways
- The four common data types are public, private, sensitive, and confidential.
- Public data is a low-level asset. Sensitive and confidential data are high-level assets.
- Even public data needs basic protection.
- Classification helps you prioritize what to protect most.
- Always learn your organization’s own data classification policy.