1. CSN
  2. All Volumes and Issues
  3. Volume 6, Number 1, 2024
  4. Methodology for Collecting, Processing, Storing, and Classifying Data in Accordance With SOC2 Type2 Requirements

Methodology for Collecting, Processing, Storing, and Classifying Data in Accordance With SOC2 Type2 Requirements

CSN.
2024;
Volume 6, Number 1
: pp. 36 - 43
https://doi.org/10.23939/csn2024.01.036
Authors:
  1. Oleg Deineka
  2. Leonid Bortnik
1
Lviv Polytechnic National University, Ukraine
2
Lviv Polytechnic National University, Information Security Department

This article explores the creation of a data classification policy in line with SOC 2 Type 2 compliance requirements. SOC 2 Type 2 is a notable certification that attests to an organization’s ability to adhere to the Trust Services Criteria, including security, availability, processing integrity, confidentiality, and privacy.

The initial and crucial step in formulating a solid data security strategy is data classification, which helps organizations recognize their data and assign a sensitivity level, guiding the appropriate security measures. Data classification aims to organize and manage data in a manner that enhances its protection and aligns with the organization's overall data security strategy. In the data classification process, data security has a central role as it directly impacts the protection and management of classified data.

The design of a data classification policy for SOC2 Type 2 compliance presents several challenges and considerations. Organizations must understand the scope of their data, align with the Trust Services Criteria, balance security with usability, provide training and awareness, conduct regular updates and policies and controls, handle third-party vendors, monitor and enforce, and comply with legal and regulatory requirements.

SOC2 Type 2
storage standards
data classification
data storage
data security
  1. Matturdi B., Zhou X., Li S. and Lin F. Big Data security and privacy: A review, in China Communications, vol. 11, No. 14, pp. 135–145, 2014. DOI: 10.1109/CC.2014.7085614
  2. Susukailo V., Opirskyy I., Vasylyshyn S. Analysis of the attack vectors used by threat actors during the pandemic // 2020 IEEE 15th International Scientific and Technical Conference on Computer Sciences and Information Technologies, CSIT 2020 – Proceedings, 2020, 2, pp. 261–264, 9321897. DOI: 10.1109/CSIT49958.2020.9321897
  3. Islam M. N., Zaki T., Uddin M. S., Hasan M. M. Security threats for big data: An empirical study. Int J Inf Commun Technol Human Dev (IJICTHD). 2018; 10(4): pp. 1–18. DOI:10.4018/IJICTHD.2018100101
  4. Singh A., Kumar A., Namasudra S. DNACDS: Cloud IoE big data security and accessing scheme based on DNA cryptography. Frontiers Comput. Sci. 18(1): 181801 (2024).  DOI: 10.1007/s11704-022-2193-3
  5. Harasymchuk O. I., Kostiv Yu. M., Maksymovych V. M., Mandrona M. M. Generator of pseudorandom bit sequence with increased cryptographic security // Metallurgical and Mining Industry: scientific and technical jornal. Dnipropetrovsk, 2014,  No. 5, pр. 25–29. Available at: https://www.metaljournal.com.ua/assets/Journal/6-KostivY.pdf (Accessed: 15 March 2024).
  6. Lakhno V., Kozlovskii V., Boiko Y., Mishchenko A., Opirskyy I. Management of information protection based on the integrated implementation of decision support systems // Eastern-european journal of enterprise technologies. Information and controlling system. Vol. 5, No. 9(89), 2017, p. 36–41. DOI: 10.15587/1729-4061.2017.111081
  7. Hulak H., Kriuchkova L., Skladannyi P., & Opirskyy I. (2021). Formation of requirements for the electronic record-book in guaranteed information systems of distance learning. Paper presented at the CEUR Workshop Proceedings, 2923 , 137–142. Available at: https://ceur-ws.org/Vol-2923/paper15.pdf  (Accessed: 15 March 2024).
  8. Maksymovych V., Shabatura M., Harasymchuk O., Karpinski M., Jancarczyk D., Sawicki P. Development of Additive Fibonacci Generators with Improved Characteristics for Cybersecurity Needs. Appl. Sci. (2022), 12(3), 1519. pp. 1–12. https://doi.org/10.3390/app12031519
  9. Maksymovych V., Shabatura M., Harasymchuk O., Shevchuk R., Sawicki P., Zajac T. Combined Pseudo-Random Sequence Generator for Cybersecurity. Sensors 2022, 22, 9700. pp.1–17. https://doi.org/10.3390/s22249700
  10. Available at: https://secureframe.com/hub/soc-2/compliance-documentation (Accessed: 15 March 2024).
  11. Available at: https://www.iso.org/standard/27001 (Accessed: 15 March 2024).
  12. Maksymovych V., Nyemkova E., Justice C., Shabatura M., Harasymchuk O., Lakh Y., Rusynko M. Simulation of Authentication in Information-Processing Electronic Devices Based on Poisson Pulse Sequence Generators. Electronics. (2022); 11(13):2039. p.18 https://doi.org/10.3390/electronics11132039
  13. Yi J., Wen Y. An Improved Data Backup Scheme Based on Multi-Factor Authentication. BigDataSecurity/HPSC/IDS 2023: pp. 187–197 Available at: https://ietresearch.onlinelibrary.wiley.com/ doi/10.1049/iet-ifs.2016.0103 (Accessed: 15 March 2024).
  14. Shevchuk D., Harasymchuk O., Partyka A., Korshun N. Designing Secured Services for Authentication, Authorization, and Accounting of Users (short paper). CPITS II 2023: pp. 217–225. Available at: https://ceur- ws.org/Vol-3550/short4.pdf (Accessed: 15 March 2024).
  15. ARMA International, Information Classification: Getting It Right. Available at: https://www.arma.org/ (Accessed: 15 March 2024).
  16. Vic (J. R.) Winkler. Securing the Cloud: Cloud Computer Security Techniques and Tactics, pages 314, 2011. Available  at:  https://www.amazon.com/Securing-Cloud-Computer-Security-echniques/dp/1597495921 (Accessed: 15 March 2024).
  17. Karumanchi Narasimha. Data Structures and Algorithms Made Easy. Pages: 432, Year of Release: 2016. Available at: https://www.amazon.in/Data-Structures-Algorithms-Made-Easy/dp/819324527X (Accessed: 15 March 2024).
  18. Watson Richard T. Data Management: Databases and Organizations. Pages 624, Year of Release: 2017. Available at: https://www.ebay.com/itm/335087377552 (Accessed: 15 March 2024).
  19. Rhodes-Ousley Mark. Information Security: The Complete Reference, Second Edition, pages 896, 2012.
  20. Cote Christian, Lah Matija. Professional Microsoft SQL Server 2014 Integration Services (SSIS). Pages: 912, Year of Release: 2014. Available at: https://www.amazon.com/Professional-Microsoft-Integration-Services- Programmer-ebook/dp/B00JSQ3RLG (Accessed: 15 March 2024).
  21. Harenslak Bas P. (Author), Rutger de Ruiter Julian. Data Pipelines with Apache Airflow Pages: 480, Year of Release: 2021. Available at: https://www.amazon.com/Data-Pipelines-Apache-Airflow-Harenslak/dp/1617296902 (Accessed: 15 March 2024).
  22. Available at: https://docs.aws.amazon.com/glue/ (Accessed: 15 March 2024).
  23. Available at: https://learn.microsoft.com/en-us/azure/data-factory/  (Accessed: 15 March 2024).
  24. Hoberman S. Data Modeling Made Simple: A Practical Guide for Business and IT Professionals, Pages: 314, Year of Release: 2005. Available at: https://www.amazon.com/Data-Modeling-Made-Simple- Professionals/dp/0977140008 (Accessed: 15 March 2024).
  25. Data Classification: Algorithms and Applications / edited by Charu C. Aggarwal. Pages: 598, Year of Release: 2014. Available at: https://doc.lagout.org/science/0_Computer%20Science/2_Algorithms/Data%20... Algorithms%20and%20Applications%20%5BAggarwal%202014-07-25%5D.pdf (Accessed: 15 March 2024).