Security+ — Part 6: Data Types, Classifications & Security Models
Welcome Back!
Data protection starts with knowing what you’re protecting. Not all data carries the same risk — a press release is public, payroll data is restricted, and classified government records require an entirely different level of control. Data classification is the process of assigning those levels and enforcing the right protections for each.
This is Part 6 of the Security+ series. Full notes on GitHub.
Data Types
Different data types require different protection mechanisms, especially when they’re regulated or business-critical.
- Regulated Data — PHI (health), PCI (financial), PII (personal) — governed by laws and frameworks
- Trade Secrets — confidential internal formulas, business logic, or strategic plans
- Intellectual Property (IP) — patents, trademarks, copyrights, and creative works
- Legal Data — contracts, litigation documents, regulatory disclosures
- Financial Data — income statements, payroll, investments, and budgets
- Human vs. Non-Human Readable — PDFs and emails vs. machine code or binary data
The type of data determines which regulations apply to it and what controls are required.
Data Classification
Classification labels data based on its sensitivity, determining how it should be stored, accessed, and protected.
Common Organizational Levels
| Level | Description |
|---|---|
| Public | Intended for open consumption — press releases, marketing |
| Internal | For use within the organization only |
| Confidential | Sensitive data that could cause harm if leaked |
| Restricted / Critical | High-sensitivity data requiring the strictest controls |
U.S. Government Classification
| Level | Description |
|---|---|
| Confidential | Lowest level — unauthorized disclosure could cause damage |
| Secret | Serious damage if disclosed |
| Top Secret | Exceptionally grave damage if exposed |
Classification only works if it’s consistently applied and enforced — a “confidential” label on a file doesn’t help if anyone can access it.
Formal Security Models
Security models are theoretical frameworks that define rules for how data should be accessed and modified. They’re the basis for real access control implementations.
Bell-LaPadula (BLP)
- Focus: Confidentiality
- Rules: No Read Up (can’t read data above your clearance), No Write Down (can’t write data to a lower classification)
- Use Case: Military and government systems where preventing leakage is the priority
Biba
- Focus: Integrity
- Rules: No Write Up (can’t write to a higher integrity level), No Read Down (can’t read from a lower integrity level)
- Use Case: Healthcare and financial records where data accuracy matters most
Clark-Wilson
- Focus: Integrity through process enforcement
- Key Concepts: Separation of duties, well-formed transactions — only authorized programs can modify data
- Use Case: Commercial applications and accounting systems
Brewer-Nash (Chinese Wall / Cinderella Model)
- Focus: Dynamic confidentiality, conflict-of-interest prevention
- Rule: Access changes based on what data the user has already accessed — prevents one client’s data from being accessed after viewing a competitor’s
- Use Case: Legal firms and consulting companies handling multiple clients
Summary
| Area | Focus | Examples |
|---|---|---|
| Data Types | What to protect | IP, PHI, PII, contracts, financial data |
| Classification | Sensitivity level | Public, Internal, Confidential, Restricted |
| Security Models | Access rules | Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash |
These classification principles connect directly to compliance. If you want to see how data classification requirements show up in SOC 2 and NIST CSF, the SOC 2 & NIST CSF series covers the control requirements in detail.
Part 7 covers monitoring, logging, and firewalls
Stay Curious!