A 3-dimensional security classification for information

Abstract

Most existing information security classification schemes use a 1-dimensional scale such as [top secret, secret, employee confidential, company confidential, restricted]. These classification schemes do not differentiate between the different security properties of information, nor between the level and the scope of security. In this paper, it is shown that a 1- dimensional classification scheme is inadequate and can result in inappropriate protection, causing increased cost and risk. A 3-dimensional security classification scheme for information is proposed and it is shown how this scheme can be used to provide adequate and appropriate levels of security.