Cyber security month: ‘What’s the quickest way to keep your data safe? Add a label’
October is the month of the autumn holiday and Halloween, and also the month when we call for extra attention to cybersecurity. Working securely online can be about surprisingly minor actions, says Information Security Officer Aram Segaar: 'Such as adding a sensitivity label to your files.'
Not enough time to read the whole article? The key points are listed below:
- A sensitivity label is a tag that lets you show how sensitive or confidential certain files are. These can be not only research data, but also grade lists, reports and work agreements.
- There are four labels you can choose from: public, internal, confidential and secret
- Adding a label is quick and easy and can make a big difference. It helps our ICT systems protect your data better, for example by making sure it doesn’t end up in insecure tools or isn’t shared by mistake externally.
- Use this infographic to see which label applies to your file.
Hi Aram, what are sensitivity labels and why do we use them?
‘Sensitivity labels are tags that show you how sensitive or confidential data is. This doesn’t just apply to research data but all kinds of information, from contracts and reports to grade lists and thesis assessments. Based on a label, you can determine what you can, may and want to do with the data. For example, may a file be published online, or shared with other people via the mail? Labels also let us take appropriate measures to protect sensitive data. This year, a new cybersecurity law has also been introduced, which we as a university are obliged to observe.’
What labels can we choose from?
‘At the moment we are working with four different levels: public, internal, confidential and secret. Public data, such as degree programme information, published research or a job vacancy on the website is accessible for everyone. Data that we want to use only internally includes such things as work agreements and thesis assessments. GROW reports, grade lists or traceable research data are handled even more securely using the “confidential” label. The “secret” label is used for such data as the notes made by a student psychologist, criminal justice documents or research that has a dual application and can therefore also be used in military contexts.’
‘If you can make it clear at a glance which groups data is intended for and how it should be handled, it makes working with the data simpler.’
Adding a label takes very little effort, but it is an extra action. Why is it so important to do?
‘Because handling data without proper case can have serious consequences. We live in a rapidly changing world where a data leak can escalate very quickly. If we know what kind of data we are dealing with, we can be smarter in how we handle it. Labelling should also help simplify working together. If you can make it clear at a glance which groups data is intended for and how it should be handled, it makes working with the data simpler.’
How does a label help protect sensitive data?
‘When files have a label, our systems can take technical measures, such as encryption and blocking for external use, downloading or copying. That means we are able to ensure that sensitive data does not unintentionally get mailed to external recipients or shared with external systems. That is also important for our teaching and research: when you keep good hold of what distinguishes you as a teacher or researcher, we can also retain our added value as a university. By leaving your data without a label, and then sharing it with a public AI tool that learns from it and assimilates the information, you are giving away our confidential information and our competitive edge.’
How do I know which sensitivity label I need for my data?
‘You can find more information about what each label means and a useful flowchart on the staff website. If you aren’t sure, choose at least the “internal” label. That is for now the golden rule.’
‘Labeling is a way of safely making use of the remarkable advances in AI and the many advantages it offers.’
Anything you’d like to add?
‘It may take some getting used to in the short term, but ultimately labelling is something that has to be part of our daily work. Personally, I see it is a basis for progress, a way of handling our data more smartly and safely making use of the remarkable advances in AI and the many advantages it offers. When you leave your house, you switch off the lights and lock the door. Those are also security measures and we think they are the most natural thing in the world. Labelling our data in the same way will take a little time to become ingrained, but it is something that we have a duty to ourselves to do.’
Aram Segaar is Information Security Officer at the Security Office of the university.
Dare to ask
If you have any questions about data breaches or security incidents, please send an email to the Privacy or Security Office via privacy@bb.leidenuniv.nl or security@bb.leidenuniv.nl. You can also always contact the privacy or security officers from your faculty or department. Find your contact person on the staff website.
Report incidents
Do you think you may be dealing with phishing, a data breach or malware? Always report this to the ISSC Helpdesk (tel. 8888). Also report loss of confidential data to your own manager.