CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [159]
NDAs are common in the technology arena. Make sure you read any NDA thoroughly before you sign it. You don’t have to sign an NDA to be bound by it: If you agree that you’ll treat the information as private and then receive the information, you have in essence agreed to an NDA. In most cases, this form of verbal NDA is valid for only one year.
Statements indicating privacy or confidentiality are common on limited-access documents. They should indicate that disclosure of the information without permission is a breach of confidentiality. This may help someone remember that the information isn’t for public dissemination.
Full Distribution
Marketing materials are examples of information that should be available for full distribution. Annual reports to stockholders and other information of a public-relations nature are also examples of full-distribution materials.
The key element of the full-distribution classification involves decision-making responsibility. Who makes the decision about full disclosure? Larger organizations have a corporate communications department that is responsible for managing this process. If you aren’t sure, it’s a good idea to ask about dissemination of information. Don’t assume that you know: This is the purpose of an information classification policy.
Private Information
Private information is intended only for use internally in the organization. This type of information could potentially embarrass the company, disclose trade secrets, or adversely affect personnel. Private information may also be referred to as working documents or work product. It’s important that private information not be disclosed because it can potentially involve litigation if the disclosure is improper.
You’ll learn about the difference between internal and restricted information in the following sections.
Internal Information
Internal information includes personnel records, financial working documents, ledgers, customer lists, and virtually any other information that is needed to run a business. This information is valuable and must be protected.
In the case of personnel and medical records, disclosure to unauthorized personnel creates liability issues. Many organizations are unwilling to do anything more than verify employment because of the fear of unauthorized disclosure.
A school views student information as internal. Schools can’t release information about students without specific permission from the student.
Restricted Information
Restricted information could seriously damage the organization if disclosed. It includes proprietary processes, trade secrets, strategic information, and marketing plans. This information should never be disclosed to an outside party unless senior management gives specific authorization. In many cases, this type of information is also placed on a need-to-know basis—unless you need to know, you won’t be informed.
Government and Military Classifications
The U.S. government and the military have a slightly different set of concerns relating to information classification. Governmental agencies are concerned about privacy and national security. Because of this, a unique system of classification and access controls has been implemented to protect information.
Following is a list of some of the types of government classifications:
Unclassified This classification is used to indicate that the information poses no risk of potential loss due to disclosure. Anybody can gain