Language

🇬🇧English🇩🇰Dansk🇸🇪Svenska🇩🇪Deutsch

Security classification

The breach after the breach

An attacker in one mailbox does not stop at the mail. They search it. What they find is the firewall config someone sent to a supplier, the VPN password in a 2019 onboarding thread, the network diagram attached to a project plan. Those are classifications too.

Try now for freeSee the platform

Security classes

7

kinds of data an attacker looks for once they are inside

  1. Classify (this page)Decide what the data actually is.
  2. VerifyLet the person who owns it confirm.
  3. ActBlock, strip, relabel or remove.

Classification

Awaiting capture

The security classification group listing passwords and secrets, digital certificates, infrastructure config, log files, network access control, physical security and security incidents

public/product/classification-security-classes.webp

Security classes are their own group, separate from the privacy ones, because they answer a different question and go to a different person.

The distinction

Why this is a separate question

Privacy classification asks whose data this is. Security classification asks what it would give away.

1

Different data, different classes

Passwords and secrets, digital certificates, infrastructure configuration, log files, network access control, physical security and security incident reports. None of it is personal data, and a privacy classifier walks straight past it.

2

Different owner, different report

A GDPR finding goes to the data owner for verification. A leaked private key goes to the CISO, now, and the action is rotation rather than deletion. The DPO gets the notification list; this one is for security.

3

Different clock

Personal data that should have been deleted is a compliance problem that grows slowly. A credential in a shared mailbox is a live exposure that is either still valid or is not.

Security classes

What it looks for

01

Credentials

Passwords and secrets

Credentials pasted into mail, API keys in attachments, service account passwords in onboarding documents and the spreadsheet somebody keeps them in.

02

Keys

Digital certificates

Private keys and certificates mailed between teams or suppliers, which stay valid long after the thread is forgotten.

03

Estate

Infrastructure config

Firewall rules, server configuration, network diagrams and access control lists: the map an attacker would otherwise have to build by hand.

04

Traces

Log files

Logs attached to support threads, which carry internal hostnames, user names, tokens and sometimes the contents of a request.

05

Physical

Physical security

Door codes, alarm procedures, key-holder lists and site plans, which are rarely treated as data at all.

06

Incidents

Security incidents

Incident reports and post-mortems, which by their nature describe exactly which weakness was exploited and how.

Questions about security classification

Is this the same engine as the privacy classification?+
Yes, with its own classes and its own dictionaries. See classifying personal data for how the engine itself works.
What does NIS2 have to do with it?+
NIS2 asks you to manage risk across your estate, and an estate includes the credentials and configuration sitting in unstructured data. Most organisations have never looked there.
Should this data be deleted?+
Often, but rotation comes first. A deleted copy of a password that is still valid has not reduced the risk. Deletion follows the rotation.

Find out what is already exposed

Monitor 250 mail accounts for free and see what the security classes return.

Start now

No credit card required.