Let's start with encryption. Encryption to understand how we manage it in an operational environment, there are some basic concepts we need to introduce first, how to manage data, practically data handling the retention and disposal of data, what happens when data has expired, when it's no longer needed? Do we just delete it? What about paper records? These practical issues or ones we need to consider in terms of information management and crypto plays a part in this or can play a part in this as well. We'll look at logging, symmetric encryption, and asymmetric encryption; two ways we can divide the crypto world up. We'll look at the difference in terms of the algorithms that are used, but also practically, what those two terms means; symmetric and asymmetric. We'll also look hashing; a way of managing integrity. Data handling. We've said already that information is an asset and according to its value, we need to protect it. Here we see on the right, the information life cycle. Information is created. As soon as it's created, it is stored somewhere. Even if that's a temporary file or in random access memory, it is stored somewhere and that enables us to use it, to share it. At some point, we may wish to archive it, to back it up. That's a form of archiving. We create a copy that increases our availability that allows us to recover from a disaster. We could also archive documents that are no longer needed in a live environment. Again, we see this in paper and in digital format. Then ultimately, all things that are created need to have an end. Information is no different. We need to plan according to that. Information needs destroying. When we destroy it, we need to destroy it in a way that is appropriate. One of the easiest ways to judge how we would destroy something is by using its classification. Classification is a way of judging its value. We have a risk-based approach to security, the risk that is posed to our asset. How big is the threat? How great is the likelihood? Do we have any vulnerabilities that we're aware of? Combining this with the asset value gives us a really good understanding of how we would want to protect our information assets. We talked a little bit about classification. This is a way to reflect the value of an asset or a group of assets. Not all assets are easy to place a financial value on. Asset classifications allow us to group assets together according to their value or according to their sensitivity and then we can apply a group of controls to them. This is driven by what the organization needs, perceived risk to the asset, the type of the asset may be driven by regulatory requirements. Some things we have to do regarding privacy for example. Most classification systems have at least three levels. They don't have to have three levels. A good practice is to have as few as you need. An example classification system might be public, private, secret, and top secret. A four-level model. We do want those levels to be descriptive, guiding people in allocating assets into the proper category. Numerical Classifications 1, 2, 3, 4 might look good on paper as a concept, but actually, when people come to use them, it's easier to make mistakes. People won't necessarily feel as ready and awareness around whether Level 1 or Level 4 is the most sensitive. By having some descriptive name like secret or top secret, it gives us some guidance in terms of the use of the system. Too many levels can also cause confusion and can drive misclassification. For these to work well, they have to be used consistently and accurately. In order for them to be used well then we need people to be trained in the classification system to understand what the classification system is and how we expect them to use it. Now, within a classification system, like top secret or secret, for example, within a level like secret or top secret. Just because of your clearance, let's say we have a general in the military with a clearance of top secret. An equivalent classification of assets of top secret might lead you to think that the general has access to everything within that classification level. Conceptually that might be true. What we do try to do is to enhance protection using the need to know. We break that classification level up into smaller subgroups where you are allowed access only to those things that you actually need to know in order to get your job done. If we had three projects all marked top secret, that information all classified as top secret, if a general was working on only one of those three projects, the general would be granted access only to one of those three projects and not to the other two. Even though the classification is equivalent to the general's clearance. When we classify our information assets in order to make sure they are handled correctly, we need to make sure that they are labeled. Labeling should be clear, but also should make sure that it's not increasing the risk to that asset. For example, if we had a piece of removable media marked super top secret, anybody finding that may be benefited from knowing that the classification is super top secret by being able to better protect it. But it may also mark that asset has a target. Something marked top secret or super top secret if somebody breaks into a building, what might they steal? Well, the thing that is highest value and the labeling might mark it out as being particularly high value. What we can do is you slightly less obvious labeling. We might mark it for super top secret as just as an example, we could market STS, super top secret which would have meaning internally that may be less obvious to somebody who's breaking into our building. Again, consistency of use here is critical. We need to make sure that effective classification occurs for the labeling itself to be meaningful. We see that reference again to the importance of training. We mentioned data having a life cycle and ultimately needing to be disposed off. Sometimes that's a fairly natural process within the context of the organization. Something is required by our organization, and then it is no longer required. Therefore, we can either archive it or ultimately delete it. However, there may be regulatory requirements, legal requirements. Some of these might mandate a minimum retention period, some might mandate a maximum retention period. Again, these requirements can a more be different between jurisdictions. In order to make sure that we're compliant, we need the appropriate governance and documentation or policies and procedures, and where we have policies and procedures we need training. But we need a very clear understanding of what we must retain. Some examples of things that might have mandated minimum retention requirements. Health records, health data, social care data, finance data. If you have finance data, usually there is a minimum requirement for retention. You cannot dispose of the records. But the opposite end of the spectrum, there may be things that we must not keep. This may be sensitive government information, more likely for most organizations. Now, this relates to privacy. If you collect the data belonging to a data subject, belonging to an individual, personal data, there are many different regulatory requirements most of which specify that you can only keep that data for as long as you need the data to complete the primary purpose, the reason it was collected. If you collect data, for example, if you collected resumes for people applying for a job, you have collected the data, you have agreement that you may collect that personal data with people's telephone numbers, addresses. But you can only keep it for as long as you need to fulfill the primary purpose and the primary purpose in this case, maybe some recruitment exercise. Some things we cannot keep perhaps as long as we would want to, certainly not indefinitely. Understanding your position with regard to what you must keep and must not keep is more complex than it sounds. It's very easy thing to say, be compliant, understand what you must keep, what you must not keep. Practically, even in smaller organizations this can be complex. Partly because privacy, regulatory compliance, legal requirements, they change between different jurisdictions. If you operate as a global organization, some things you must keep, some things you must not keep. Understanding the difference can be complex. When we're looking at long term retention for things like health records, it's not uncommon to see a requirement that you must hold them if you're a health care provider for terms as long as 100 years. If you are going to keep something for that period of time, what does that mean in terms of format, in terms of how you retain it? Do you think about some of the format obsolescence that we see? This might help shape our thinking. Maybe we keep it in a format that we believe or that we think is likely to be available for a longer period of time. If we look at some of the old file formats, Word Perfect, works and others, laser disc. Some of the media restrictions, some of the format restrictions might affect the availability of that data over the medium to long term.
