Security/Data Classification
|
READY
The data classification is intended to allow Mozilla to operate effectively in the open while protecting sensitive information. These data classification levels use the colors of the Standard Levels.
This classification scheme is solely meant to communicate who the intended audiences of a particular file is, not what type of content is contained within the document.
Updates to this page should be submitted to the source repository on github. Changes are detailed in the commit history. The Mozilla Security Assurance team maintains this document. |
Mozilla Data Classification
| Sharing data |
|---|
|
When sharing or distributing data, documents, etc. you are responsible for setting and changing a classification label. While it is required for all Google Drive documents, it is strongly advised that you use them with any tools and communications systems where Mozillians may share information. (e.g.: text documents, attachments to emails, Matrix topics, and other digital media documents). |
| Label | Definition |
|---|---|
| Public | Data that can be shared with the world.
The audience of this data is meant to be anyone, internal to Mozilla or the wider public. |
| Mozilla Confidential - Staff and NDA'd Mozillians Only |
The audience of this data is any employee of the Mozilla Foundation, Mozilla Corporation or any other Mozilla subsidiary as well as any individual/entity that has an NDA with Mozilla. |
| Mozilla Confidential - Specific Workgroups and Individuals Only | The audience of this data is meant to be specific workgroups or specific individuals. A Workgroup is a specific group of people, like a team. Use of this label requires the author to list out each workgroup and/or individual that the data is intended for, somewhere in the file. |
Examples of data classification
The list of examples is not an exhaustive list, nor should this list be taken as classification of types of data, only intended audiences.
| Label | Examples |
|---|---|
| Public |
|
| Mozilla Confidential - Staff and NDA'd Mozillians Only |
|
| Mozilla Confidential - Specific Workgroups and Individuals Only |
|
Deciding how to classify
The list of examples of how to label data is not an exhaustive list and serves an an indication on how to ensure the data classification labels are clearly communicated.
There are always at least two people involved with exchanging confidential information:
- The Owner is the person who created the file. The Owner and Discloser are often the same person, but not always.
- The Discloser is the person who provides/sends/shares the information to the Recipient.
- The Recipient is the person who receives the information.
When in doubt, it's always best to classify at the most specific classification.
All new documents, box.com, etc.
Label every document with its appropriate classification at the top of the document if possible. When possible, we recommend using the header feature of the document.
Google Apps
Label every document (Docs, Sheets, Slides, Drawings, etc.) with its appropriate classification by utilizing the required label functionality.
- For Docs, we recommend including the label in the header of the document.
- For Slides, we recommend including the label in the master slide so that it shows on all slides.
- For Sheets, we recommend creating a dedicated sheet (the tabs at the bottom of the page) either called "Data Classification" or the name of the classification for the entire file. In that new sheet, indicate the data classification.
Wikimo (mediawiki), GitHub public repos
- All documentation is by default Public on https://wiki.mozilla.org
- No confidential information may be hosted on the wiki.
Email subject lines
- Mozilla Confidential - Specific Workgroups and Individuals Only information must be labeled in the subject line and should not be forwarded without the original senders express permission.
- For other emails, optionally label subjects with the appropriate classification. This one is up to you, but we encourage you to label emails when the subject is sensitive and it is important to alert recipients.
Matrix
Set your Matrix channel topic to start with the classification label. This is also recommended for public channels.
Also ensure that non-public channels are protected by password or channel access control.
Remember that Mozilla Confidential - Staff and NDA’d Mozillians Only and Mozilla Confidential - Specific Workgroups and Individuals Only may not be shared on Matrix.
Ex: "PUBLIC | This is a channel to discuss anything you like about Firefox".
Zoom, Hello, Hangouts, Skype and other video conference tools
- When using video conferencing, if this is not a public call - ensure that only the people who need to know the information have access to the video conference and chat.
- Verify the list of participants and verbally announce if you're going to share any non-public information.
Code and configuration deployments
When committing or deploying code that handles credentials:
- Ensure that the credentials are stored in a separate file (if possible encrypted).
- Optionally label the file with a comment mentioning it's data classification label (either inside the file or as a file attribute, or even in the file name if it makes sense)
