When you label everything “secret,” it’s not security. It’s chaos.

There are several terms in cybersecurity that are often confused. Information classification, TLP protocol, security categorization, or access control are often used almost synonymously in presentations, internal policies, and marketing materials. They are not. It’s like someone claiming that a car license plate, a driver’s license, and a traffic sign are the same thing because they all relate to transportation in some way.

The result of this confusion is an environment where no one knows whether to mark a document as confidential, add TLP:AMBER to it, or put it in a restricted folder. Yet each of these measures addresses a completely different issue. If we confuse them, the result is chaos and confusion that leads to a false sense of security. This is just as dangerous as ignoring the rules.

Four Questions for a Security Architect

Imagine a situation where you receive information about a new critical vulnerability. Before you start sharing or storing it, you should answer four simple questions.

1) How sensitive is this information?

2) Who can we share it with?

3) Who can access it?

4) What are the consequences if it is compromised?

Each of these questions is addressed by a different standard or methodology. Without an understanding of these rules, any attempt to classify data will end in the aforementioned chaos.

TLP is not a classification

The Traffic Light Protocol (TLP), managed by FIRST, was created as a simple way to manage information sharing between organizations. Its purpose is not to determine the sensitivity of information, but to establish rules for its further dissemination. TLP does not say how important or classified the information is. It only says who can share it further. Any part of the standard is an indication of what the TLP protocol is intended for. Nowhere is it mentioned whether the information is secret, confidential or public. TLP simply does not determine the sensitivity of information.

In TLP 2.0, there are five levels:

TLP:CLEAR – information can be shared publicly.

TLP:GREEN – can be shared within the community.

TLP:AMBER – only within the recipient's organization.

TLP:AMBER+STRICT – only to specific recipients.

TLP:RED – only to participants in the original communication.

If we obtain information about a new critical vulnerability, it may contain publicly known information and still be marked as TLP:RED. The manufacturer simply does not want to allow the dissemination of this information outside the security team. The same information can be marked as TLP:CLEAR a few days later, even though its content has not changed at all. TLP therefore answers only one question: Who can I forward the information to?

What question does information classification answer?

Information classification addresses its sensitivity. The organization tries to determine how serious the consequences of unauthorized disclosure, change or loss of the information would be. That is why most organizations use their own classification scheme. The most common levels are Public, Internal, Confidential and Restricted. Some companies add Secret or Highly Confidential, while others only use three levels. In the private sector, it is often possible to come across a document marked as "Confidential". In contrast, the state administration uses legally defined levels of secrecy. Both solutions can be correct, although they look different.

Neither ISO/IEC 27001 nor ISO/IEC 27002 prescribe specific class names. They only require that the organization establish a classification, use it consistently, and that it corresponds to the actual risks. This is an important difference from TLP. ISO says that a classification should exist, but does not specify its form.

There is another difference. Government administrations usually have classification properties clearly defined by law. A private company cannot therefore give its internal documents a label such as "SECRET", thus suggesting or claiming that they are of a state level of secrecy. Such a label could be misleading, especially if the documents are shared outside the company or with state institutions. Therefore, the classification should be clearly defined and differentiated. On the other hand, it is not generally forbidden to use similar terminology, if it is clearly stated that it is a corporate system.

FIPS 199 determines the impacts

One of the most common mistakes is the claim that FIPS 199 represents a document classification system. The American standard FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems evaluates the impact of a security incident on an information system or type of information. It assesses three basic security properties. The first is confidentiality, the second is integrity, and the third is availability. This is the well-known CIA security triad. Each of these properties is given a level of Low, Moderate, or High. The result is not a label on a document, but a security categorization of the system.

If we imagine, for example, a hospital information system, the loss ofAvailability can mean a threat to the lives of patients. In this case, availability will be rated High. Confidentiality of personal data, on the other hand, can be Moderate and integrity of records again High. This combination ultimately determines what security measures must be implemented. FIPS 199 therefore answers the question: How serious will the impacts of a security incident be?

Joining forces: FIPS and NIST

FIPS 199 itself is a relatively brief document. Practical use is described only in NIST SP 800-60, which shows how to categorize individual types of information. The next document following the document determining impacts is FIPS 200. This sets out minimum security requirements for federal information systems. The last document is NIST SP 800-53. Tent contains a catalog of security measures that should correspond to the resulting security category.

Thus, FIPS 199 determines the impact of a data breach, NIST SP 800-60 the severity, and NIST SP 800-53 the method of resolution.

FIPS 199 therefore determines the security impact category (impact level) based on confidentiality, integrity, and availability. NIST SP 800-60 helps determine this category for specific types of information and information systems. NIST SP 800-53 defines the security and protection measures (controls) that should be implemented to reduce risk. FIPS 200 fulfills the role of translating the determined impact level into minimum security requirements for federal information systems.

Government sector

Public administration and security agencies do not use the same classification levels as commercial companies. Legislation mandates uniform labeling of classified information. For this reason, commercial organizations must implement clearly distinguishable levels of data classification. The European Union uses four levels of EU Classified Information. NATO uses its own classification scheme. Individual member states then have national classification systems that are mapped to each other. These classification levels have legal significance. They are not just recommendations or internal methodologies; incorrect data evaluation has serious consequences. And this is exactly why private organizations must avoid uniform labeling.

Classification does not mean access

Let's imagine a safe full of documents marked "Secret". The label on a document does not mean that anyone with a security clearance can open all the documents. This is what access control is for. Access control determines who can read, change or delete a document. In other words, it answers the question: Who is allowed in? This is what access control addresses. There are several different methods here, hidden under the acronyms DAC, MAC, RBAC, ABAC, and others.

Let's imagine a document containing a security incident response plan. The organization classifies it as Confidential. At the same time, it marks it TLP:AMBER because it does not want it to be passed outside the organization. Only members of the security team will gain access to the document through RBAC. If the organization uses MAC, the user's security level will also be verified. If ABAC is used, the system will also check the device, location, or other attributes. Each mechanism solves a different problem. None of them replaces the others. Knowing these mechanisms and the impact of their action is an integral part of understanding the entire issue of information security management in the IT sector.

Conclusion

The most common mistakes in this area are caused by misunderstanding.

Mistake 1: that TLP represents a document classification. It does not.

Mistake 2: FIPS 199 labels documents as confidential or secret. In reality, it assesses the impact of a security incident on information systems and information types.

Mistake 3: Classification automatically determines access permissions. In reality, classification only describes the sensitivity of information. Permissions are addressed by the access control model.

Mistake 4: The organization believes that by implementing classification labels, it has solved information security. This is like a hospital deciding that once a patient has been tagged, the doctor is no longer needed. The label itself does not protect anything. True security is created by a combination of correct classification, appropriate access control, information sharing controls, and strict adherence to security rules.

I would like to appologize, this time the list of references will be much longer. It would be possible to write a times longer article about this topic.

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.