Developing an information classification method

Abstract

Purpose The purpose of this paper is to develop a method for information classification. The proposed method draws on established standards, such as the ISO/IEC 27002 and information classification practices. The long-term goal of the method is to decrease the subjective judgement in the implementation of information classification in organisations, which can lead to information security breaches because the information is under- or over-classified. Design/methodology/approach The results are based on a design science research approach, implemented as five iterations spanning the years 2013 to 2019. Findings The paper presents a method for information classification and the design principles underpinning the method. The empirical demonstration shows that senior and novice information security managers perceive the method as a useful tool for classifying information assets in an organisation. Research limitations/implications Existing research has, to a limited extent, provided extensive advice on how to approach information classification in organisations systematically. The method presented in this paper can act as a starting point for further research in this area, aiming at decreasing subjectivity in the information classification process. Additional research is needed to fully validate the proposed method for information classification and its potential to reduce the subjective judgement. Practical implications The research contributes to practice by offering a method for information classification. It provides a hands-on-tool for how to implement an information classification process. Besides, this research proves that it is possible to devise a method to support information classification. This is important, because, even if an organisation chooses not to adopt the proposed method, the very fact that this method has proved useful should encourage any similar endeavour. Originality/value The proposed method offers a detailed and well-elaborated tool for information classification. The method is generic and adaptable, depending on organisational needs.

Policy components – a conceptual model for modularizing and tailoring of information security policies

“…These modularization concepts have been used in the information security management field before, although not for this purpose. The method component format has been used when developing a method for information classification (Bergström et al , 2020); our study can be considered another example of how SME concepts can inform information security management research.…”

Problems in information classification: insights from practice

“…different people at different levels in an organization will rate scales differently (Hubbard, 2020)" (Wangen and Snekkenes, 2013, p. 5) Depending on previous experiences, roles, framing etc. one tends to interpret and value risk and value of/to assets differently (Bergström et al, 2019;Bergström et al, 2021;Bergström and Åhlfeldt, 2014; Anthony (Tony) Cox, 2008;Fenz et al, 2014;Hubbard, 2020;Kaarst-Brown and Thompson, 2015;Sajko et al, 2006;Wangen and Snekkenes, 2013) Actor subjectiveness…”

“…(Wangen and Snekkenes, 2013) Not understanding each other properly will lead to problems in discussions and interpretations of discourse (Ahmad et al, 2015;Arhin and Wiredu, 2018;Richmond et al, 2005;Shedden, 2016;Wangen and Snekkenes, 2013) Discourse interpretation "As collections of canonical practices, they 'inevitably and intentionally omit the details' (Brown and Duguid, 1991, p. 40), making them too abstract to be directly applicable to a specific organizational context." (Niemimaa and Niemimaa, 2017, p. 12) Guidelines are difficult to interpret and adapt as they often omit details (Bayuk, 2010;Bergström, 2020;Bergström et al, 2021;Brown and Duguid, 1991;Niemimaa and Niemimaa, 2017;Fibikova and Müller, 2011;Ghernaouti-Helie et al, 2011;Park et al, 2010) Difficult to adapt guidelines Source: Created by author…”

“…Differing opinions on the correct value of a certain information asset is a common topic of competing arguments between actors. Subjective judgments in the classification activities can lead to the well-known problem of inconsistent classifications (Bergström and Åhlfeldt, 2014; Bergström et al , 2021; Fenz et al , 2014; Sajko et al , 2006), and this problem is often overlooked in practice and is under-researched.…”

“…Difficult to adapt guidelines is another categorized problem (Bayuk, 2010; Bergström et al , 2021; Park et al , 2010). Standards such as ISO/IEC 27002 (ISO Central Secretary, 2017) are a commonly used base for organizations to create guidelines.…”