CCSP - Data Life Cycle

[Spirnia]

Does data classification happen during the Create phase or the Store phase?

What is the reasoning behind your answer?

[nkeaton]

@dcontestiNot sure that you understand classification and categorization in this context. Think labels. It is absolutely the responsibility of the data owner to do that for their data. I agree that ISC2 is not the expert, but CSA is, and they helped ISC2 develop the CCSP. So it is very valid and correct. As to the poster, they absolutely need to follow ISC2 definitions until they pass the exam. People often do the worst in the domain that they work in because answer from experience rather than what ISC2 wants. This is why I would never recommend Google, AI engines, or other easy resources for studying. They proved that point well with asking AI.

[dcontesti]

Using Google, AI, etc. has assisted many folks when in a quandary on a specific topic while some have thirty to forty feet of bookshelves lined with books from various authors (that sometimes contradict each other) but assist us with gaining an answer and finally, some of us have over thirty-five years in the industry and rely on our experience/knowledge.

The point that is missing is that (ISC)2 and CSA, asks the candidate to "Choose the best answer from those presented".  Exam questions should be clear, distractors (answers) should never be made up and never intended to trick a candidate.

As to CSA being the experts, they are also a group of volunteers (that come to consensus) who develop exams and provide trainings and guidance.

d

[nkeaton]

@dcontesti   They are not good for studying for exams.  I like to use the example of the lawyer who used it for precedents in a case.  This is why I like CC's Verify; then trust.  He did not do that.  The judge recognized that they were not valid.  So much for professionalism.  As far as volunteers for developing questions, I can assure you that we are all professionals or would not be accepted to do that.  We sign NDAs and work very hard.  I feel like it is important to give back to the community and help others.  

[dcontesti]

@nkeaton 

No where in any of my replies did I suggest that they were good for studying, so please do not put words in my mouth.

The original question asked " where does data classification begin" and explain your response.  Which is what I did.  As I have developed a data classification system for a Global company that employees over 300M people, I offered my opinion and justification.  If you disagree with my definition, that's fine.

As to Exam Development, I understand the process far more that you would expect.  You see at one point during my volunteer days (when the organisation had not money), I actually ran workshops, had NDAs signed and work very hard, this all prior to Casey and folks like Vehbi, Tony, etc.  I am truly aware of the process.

You seem to enjoy putting words in my mouth.  I never said that the volunteers do not work hard.  Believe it or not (ISC)2 would not be where it is without their volunteers.

Please stop putting words in my mouth, it shows as unprofessional and a need to be continuously right

FYI:  I am adding the admins here, so they are fully aware @Kaity 

[learningdaily]

In my opinion, data classification should begin at the creation of the data. Before this, it is essential to have a well-defined classification guide to simplify the decision of which label to choose.

Defining data at the "storage" phase defeats the purpose of classification.

For example, if the classification guide includes categories such as proprietary, public, and confidential, each with specific system requirements for storing their respective data types, the data creator must label the data appropriately from the start, or else the system on which the data is created and stored may not meet the requirements of the data type.

I am interested in hearing others' opinions.

[Kaity]

@nkeaton Please be respectful in this forum. Folks are welcome to disagree with each other, but do not make accuasations or disaparaging remarks. This behavior will not be tolerated. 

Thanks all! 

[nkeaton]

@dcontesti   I never said that you were recommending AI for studying.  I don't recommend it because it definitely won't follow ISC2, and as I indicated people don't check the results which is why I like CC's Verify; then trust.  I am sorry that you think like you do about me.  I agree that volunteering is very important.  As far as professionalism, I do not think that I have ever insulted you and have zero need to be right.  Only people who think that they are better than others do that.  I do not think that I am smarter or better than anyone else.  I am also not a name dropper.  I help hundreds of people every year with their cybersecurity needs and enjoy giving back to the profession.