Cracks in the security foundation: Employee judgments about information sensitivity

Despite the increased focus on IT security, much of our reliance on 'information sensitivity classifications' is based on broadly specified technical 'access controls' or policies and procedures for the handling of organizational data - many of them developed incrementally over decades. One area ignored in research and practice is how human beings make "sensitivity judgments" or 'classify' information they may encounter in everyday activities. This has left what we view as a crack in the IT security foundation. This crack has created a tension between formal IT security classification schema, technical controls, and policy, and the sensitivity judgments that everyday workers must make about the non-coded information they deal with. As noted in government and private reports, a new look at information sensitivity classification is vital to the expanding reach and criticality of information security. Based on a grounded theory study that elicited 188 judgements of sensitive information, we found valuable lessons for IT security in how workers, both in IT and outside of IT, recognize, classify, and react to their human judgments of sensitive information.