Secure storage starts with the needs of your information
Classification, permissions, sharing and traceability need to work together. Here is a practical sequence for the work.
1. Identify what you need to protect
Identify important information, where it is held and how it is used. Assess the consequences of disclosure, incorrect modification or loss of access. Classification should help the organisation choose appropriate protection, not simply label documents.
Personal data, trade secrets and other sensitive information may require different measures. Do not confuse an internal information classification with specific legal concepts such as information classified under Swedish protective security legislation.
2. Link access to the task
Describe which roles need to read, modify, share or administer information. Grant permissions according to need, review them when roles change and remove access when it is no longer required.
Rules can also take context into account, such as the device being used. Document what the rule should prevent and which exceptions the organisation needs.
3. Control sharing and use
Information often leaves its original system through links, downloads or email. Decide which sharing methods are permitted and when additional protection is needed.
Encryption, DLP and watermarking serve different purposes. They can support working practices but do not guarantee that an authorised recipient will never copy, photograph or pass on information.
4. Follow up and plan recovery
Select log events that help you investigate relevant access and changes. Restrict access to the logs and decide how long they are needed. Also check that stored information and keys can be recovered in line with business requirements.
- An information owner has approved the protection requirements.
- Permissions and sharing rules have been tested in real workflows.
- Incidents have a clear contact channel and responsible owner.
- Recovery has been tested and findings have been followed up.
Bring technology and working practices together
Start with a clearly defined information flow, make the protection understandable to users and adjust based on the findings from follow-up.
Sources and further reading
Sources reviewed .