Data is the ultimate object of the organisation’s security programme. Every physical security control that protects the facility, every network security architecture that governs the connectivity, every endpoint protection mechanism that defends the device, and every application security measure that secures the software exists to protect the data that the physical infrastructure houses, the network transports, the endpoint stores, and the application processes. The Security Consulting function’s advisory on data and information security must therefore address the security of the data itself throughout its complete lifecycle with the directness that the data-centric perspective provides, rather than only through the infrastructure-centric perspective that the physical, network, and application security layers address with the data’s protection as their ultimate purpose but not always their immediate governance focus.
The data lifecycle through which the Security Consulting function’s advisory must follow the data from its creation or acquisition through its processing, storage, transmission, use, and eventual disposal creates the security governance requirement at every lifecycle stage whose cumulative coverage ensures that the data’s confidentiality, integrity, and availability are maintained across the full range of the conditions that the data’s active operational use and eventual retirement create. The data protection failure that most consequentially affects the organisation is rarely the single control’s failure but the lifecycle governance gap that leaves the data unprotected at the specific stage where the adversary’s attack or the accidental disclosure finds it without the control that every other stage’s governance has provided.
Data Classification #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
