Discovering Sensitive Data

In this chapter we'll provide information about Sensitive Data, and cover the following topics:

1. What is Classified As Sensitive Personal Data?
2. Types of Sensitive Data
3. Is Proprietary Data Sensitive Information?
4. Where Should Sensitive Data Be Stored?
5. Monitoring Sensitive Data

Sensitive data is any confidential data stored or processed by an organization. Data sensitivity may be internal or external:

• Internally sensitive information is information which is restricted within organizational units. For example, employee salaries are sensitive, and only certain employees within the organization can access salary information (and even less employees are exposed to the entirety of salary information).
• Externally sensitive information is information which is restricted to within the organization. For example, perhaps an entire company is aware of deals in motion, but the information cannot be shared with external entities.

What is Classified As Sensitive Personal Data?

Sensitive personal data can be defined in several ways based on different regulations and locations but is generally any data about a certain person that is deemed private information.

For example, in GDPR, data is considered sensitive personal data when it includes:

• Racial or ethnic origins
• Political opinions
• Religious or philosophical beliefs
• Trade union memberships
• Genetic data
• Biometric data
• Healthcare data
• Gender identity or sexual orientation information

Types of Sensitive Data

Sensitive data can be divided into three main categories:

Sensitive business data

Any non-public and non-routine data within a company. It is debatable whether the data sensitivity depends on the damage created if exposed.

Examples:

• Financial information such as revenue and costs.
• Product plans
• List of customers

Classified data

Any information which is restricted due to security reasons.

Examples:

• Access codes to offices
• The CEO’s agenda (may contain security risks)

Personal data

Any data that can be linked to individuals and is not publicly accessible.

Examples:

• SSN (Social Security number)
• Email address
• Phone number

Of course, each regulation categorizes sensitive data differently and has varied definitions of each of these data types.

A practical approach is using such regulations and frameworks to define the types of sensitive data in the organization. For example, "HIPAA data" is any data considered sensitive by HIPAA (Health Insurance Portability and Accountability Act) and "PCI data" is any data considered sensitive by PCI DSS (Payment Card Industry Data Security Standard).

Note that certain data may fall under two or more classifications. For example, a credit card number is both a PII data (as it can identify a person) and sensitive PCI data.

Is Proprietary Data Sensitive Information?

In most cases, proprietary data is considered sensitive business information. As described above, sensitive business information is non-public and non-routine which usually also applies to proprietary information.

Where Should Sensitive Data Be Stored?

In most cases, there is not a single solution to where sensitive data should be stored, but the following guidelines may help:

If the sensitive data is not required by the organization, it becomes a liability with no value and should, therefore, not be stored.

In other cases, it is extremely important to address the following questions:

• Is the data store secure? If you’re using a cloud data warehouse, you can use guides to secure your Snowflake and secure your Redshift to ensure security.
• Do you have a retention policy for the data? Accumulated data may be categorized as having "not enough value and too much liability," in which case you should either delete it, delete the sensitive parts, or keep only an aggregation of the data.
• Do you have a way to allow users (or companies) to delete stored data about them?
• Do you have a proper and up-to-date mapping of where each type of sensitive data is located?
• Do you have a proper and up-to-date mapping of which users, groups, and roles are accessing what data?
• Do you have proper access controls in place to allow data usage but also protect it and limit access to sensitive data?

This list can help you make great progress in effectively storing your sensitive data but is very generic.

Monitoring Sensitive Data

Sensitive data is not a static object that remains in its place waiting to be discovered. Rather, it is a moving target, with sensitive data being constantly inserted, transformed, and relocated. Therefore, it is important to:

• Keep your mapping of sensitive data up-to-date by continuously assessing data sensitivity, as opposed to performing single or infrequent assessments.
• Make access controls data type, as opposed to static location, dependent. Not just a specific set of locations to restrict by. For example, instead of restricting access to a "customers" table which contains email addresses, restrict access to all email addresses in the data store.