by Angela Guess
Raef Meeuwisse recently wrote in Health Data Management, “How we apply security has to correlate with where we choose to allow electronic information of any value to travel. The term ‘choose to allow’ is used intentionally to indicate that if we have something of value, we need to apply appropriate management and protection. More than ever, we need to apply data governance, which involves putting appropriate management and control directly over our information, no matter where it is. Of course, we know that all information is not of equal value. There is no point protecting my public author bio pic with the same security I would apply to a finance system.”
Meeuwisse continues, “Data classification helps us appropriately categorize our information based on: (1) Confidentiality. The required level of secrecy and cost impact of unexpected disclosure. (2) Integrity. How tolerant (or not) any section of the information can be to being changed or lost entirely. (3) Availability. How important it is to have timely access to the information when we need it. (4) Consent. Whether there are legal requirements or restrictions in place that impact where the information can go, particularly in dealing with personal information.”
He goes on, “Data classification makes it possible to adapt the level of data governance applied to reflect the business needs, business value, regulations and sensitivity. The reality is that data classification and data governance have been at the core of our security frameworks for a long time. We have always needed to be responsible for applying security to wherever our valuable data flows. We need to stop thinking that we can defend information en bloc within a trusted defensible network. We need to go back to the basics and apply security to the information. Wherever our valuable information will be allowed to go becomes our new security perimeter.”
Photo credit: Health Data Management