and security informatics is exploring the ways in which humans categorize or classify "sensitive" information. Research and practice support the critical nature of categorization frameworks, yet there are a number of different ways humans conceptualize sensitive information. In this paper we review some of the dilemmas associated with classification of sensitive information, present different classification approaches, and then identify alternative propositions related to factors that influence judgments about degree of sensitivity. We conclude with directions for future research.

No abstract

1Despite the increased focus on IT security, much of our reliance on 'information sensitivity classifications' is based on broadly specified technical 'access controls' or policies and procedures for the handling of organizational data -many of them developed incrementally over decades. One area ignored in research and practice is how human beings make "sensitivity judgments" or 'classify' information they may encounter in everyday activities.This has left what we view as a crack in the IT security foundation. This crack has created a tension between formal IT security classification schema, technical controls, and policy, and the sensitivity judgments that everyday workers must make about the non-coded information they deal with. As noted in government and private reports, a new look at information sensitivity classification is vital to the expanding reach and criticality of information security. Based on a grounded theory study that elicited 188 judgements of sensitive information, we found valuable lessons for IT security in how workers, both in IT and outside of IT, recognize, classify, and react to their human judgments of sensitive information.