data-classification

What this skill does

# Data Classification

Comprehensive guidance for data classification, handling requirements, and data lifecycle management.

## When to Use This Skill

- Establishing data classification policies
- Defining handling requirements for different data types
- Designing data protection controls by classification
- Implementing data labeling and tagging
- Creating data retention and disposal procedures

## Classification Framework

### Standard Sensitivity Levels

| Level | Description | Examples | Impact of Breach |
|-------|-------------|----------|------------------|
| **Public** | Intentionally public | Marketing, published docs | None |
| **Internal** | General business use | Policies, org charts | Minimal |
| **Confidential** | Business sensitive | Financial reports, contracts | Moderate |
| **Restricted** | Highly sensitive | PII, PHI, trade secrets | Severe |
| **Top Secret** | Critical/regulated | Encryption keys, M&A data | Catastrophic |

### Visual Labeling

```text
┌─────────────────────────────────────────┐
│ █ PUBLIC                                │  Green
├─────────────────────────────────────────┤
│ █ INTERNAL - For Internal Use Only     │  Blue
├─────────────────────────────────────────┤
│ █ CONFIDENTIAL - Authorized Only       │  Yellow
├─────────────────────────────────────────┤
│ █ RESTRICTED - Need-to-Know Only       │  Orange
├─────────────────────────────────────────┤
│ █ TOP SECRET - Strictly Controlled     │  Red
└─────────────────────────────────────────┘
```

## Handling Requirements Matrix

### By Classification Level

| Requirement | Public | Internal | Confidential | Restricted |
|-------------|--------|----------|--------------|------------|
| **Access Control** | None | Authentication | RBAC | Need-to-know + MFA |
| **Encryption at Rest** | Optional | Recommended | Required | Required + HSM |
| **Encryption in Transit** | HTTPS | TLS 1.2+ | TLS 1.2+ | TLS 1.3 + mTLS |
| **Backup** | Standard | Standard | Encrypted | Encrypted + geo-separate |
| **Sharing External** | Allowed | Approval | NDA required | Prohibited |
| **Cloud Storage** | Any | Approved cloud | Approved + encryption | On-premises or approved |
| **Print** | Allowed | Allowed | Watermarked | Prohibited/tracked |
| **Retention** | As needed | 3 years | 7 years | 7 years + legal hold |
| **Disposal** | Standard delete | Secure delete | Cryptographic erase | Physical destruction |

### Data Flow Controls

```text
Restricted Data Flow:
┌──────────────┐     Encrypted      ┌──────────────┐
│   Source     │ ───────────────▶  │ Destination  │
│   System     │                    │   System     │
└──────────────┘                    └──────────────┘
       │                                   │
       ▼                                   ▼
   Audit Log                           Audit Log
       │                                   │
       ▼                                   ▼
  ┌────────────────────────────────────────────┐
  │              SIEM / Monitoring              │
  └────────────────────────────────────────────┘
```

## Classification Implementation

### .NET Data Annotation Approach

```csharp
// Classification attributes
[AttributeUsage(AttributeTargets.Property | AttributeTargets.Class)]
public class DataClassificationAttribute : Attribute
{
    public DataClassification Level { get; }
    public string? DataCategory { get; set; }
    public string? RetentionPolicy { get; set; }
    public string[] RequiredRoles { get; set; } = Array.Empty<string>();

    public DataClassificationAttribute(DataClassification level)
    {
        Level = level;
    }
}

public enum DataClassification
{
    Public = 0,
    Internal = 1,
    Confidential = 2,
    Restricted = 3,
    TopSecret = 4
}

// Usage on domain models
public class Customer
{
    public Guid Id { get; set; }

    [DataClassification(DataClassification.Internal)]
    public string Name { get; set; } = string.Empty;

    [DataClassification(DataClassification.Restricted,
        DataCategory = "PII",
        RequiredRoles = new[] { "CustomerAdmin", "Support" })]
    public string Email { get; set; } = string.Empty;

    [DataClassification(DataClassification.Restricted,
        DataCategory = "PII",
        RetentionPolicy = "7years")]
    public string SocialSecurityNumber { get; set; } = string.Empty;

    [DataClassification(DataClassification.Confidential,
        DataCategory = "Financial")]
    public decimal CreditLimit { get; set; }
}
```

### Classification-Based Access Control

```csharp
public class ClassificationAuthorizationHandler
    : AuthorizationHandler<DataAccessRequirement, object>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        DataAccessRequirement requirement,
        object resource)
    {
        var classificationAttr = resource.GetType()
            .GetCustomAttribute<DataClassificationAttribute>();

        if (classificationAttr == null)
        {
            context.Succeed(requirement);
            return Task.CompletedTask;
        }

        var userClearance = GetUserClearanceLevel(context.User);

        // User clearance must meet or exceed data classification
        if ((int)userClearance >= (int)classificationAttr.Level)
        {
            // Check role requirements if specified
            if (classificationAttr.RequiredRoles.Length > 0)
            {
                var hasRequiredRole = classificationAttr.RequiredRoles
                    .Any(r => context.User.IsInRole(r));

                if (hasRequiredRole)
                {
                    context.Succeed(requirement);
                }
            }
            else
            {
                context.Succeed(requirement);
            }
        }

        return Task.CompletedTask;
    }
}
```

### Field-Level Encryption

```csharp
public class ClassificationBasedEncryption
{
    private readonly IEncryptionService _encryptionService;

    public async Task<T> ProtectData<T>(T data, CancellationToken ct) where T : class
    {
        var properties = typeof(T).GetProperties()
            .Where(p => p.GetCustomAttribute<DataClassificationAttribute>() != null);

        foreach (var prop in properties)
        {
            var attr = prop.GetCustomAttribute<DataClassificationAttribute>()!;

            if (attr.Level >= DataClassification.Confidential)
            {
                var value = prop.GetValue(data) as string;
                if (!string.IsNullOrEmpty(value))
                {
                    var encrypted = await _encryptionService.Encrypt(value, ct);
                    prop.SetValue(data, encrypted);
                }
            }
        }

        return data;
    }
}
```

## Data Discovery and Inventory

### Automated Classification

```csharp
public class DataDiscoveryService
{
    private readonly IRegexPatternMatcher _patternMatcher;

    public ClassificationSuggestion AnalyzeContent(string content)
    {
        var detections = new List<DataTypeDetection>();

        // Check for PII patterns
        if (_patternMatcher.ContainsPattern(content, PiiPatterns.SocialSecurityNumber))
            detections.Add(new DataTypeDetection("SSN", DataClassification.Restricted));

        if (_patternMatcher.ContainsPattern(content, PiiPatterns.CreditCard))
            detections.Add(new DataTypeDetection("Credit Card", DataClassification.Restricted));

        if (_patternMatcher.ContainsPattern(content, PiiPatterns.Email))
            detections.Add(new DataTypeDetection("Email", DataClassification.Confidential));

        if (_patternMatcher.ContainsPattern(content, PiiPatterns.PhoneNumber))
            detections.Add(new DataTypeDetection("Phone", DataClassification.Confidential));

        // Check for financial patterns
        if (_patternMatcher.ContainsPattern(content, FinancialPatterns.BankAccount))
            detections.Add(new DataTypeDetection("Bank Account", DataClassification.Restricted));

        // Determ