Data Classification

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

# Classification Decision Tree
# Apply rules in order; first matching rule determines classification
 
classification_rules:
  - name: "Regulatory PII"
    description: "Personal data protected by GDPR, CCPA, or similar"
    criteria:
      - data_type: ["SSN", "national_id", "passport", "biometric", "health_data"]
      - contains_direct_identifier: true
    classification: "highly_confidential"
    handling:
      encryption: "required_at_rest_and_transit"
      access_logging: "required"
      retention: "per_regulation"
      deletion: "cryptographic_erase"
 
  - name: "Authentication Credentials"
    description: "Secrets that grant system access"
    criteria:
      - data_type: ["password", "api_key", "certificate", "private_key", "token"]
    classification: "highly_confidential"
    handling:
      encryption: "required_at_rest_and_transit"
      access_logging: "required"
      storage: "secrets_manager_only"
      rotation: "mandatory"
 
  - name: "Financial Data"
    description: "Data with direct financial impact"
    criteria:
      - data_type: ["payment_card", "bank_account", "salary", "revenue"]
    classification: "confidential"
    handling:
      encryption: "required_at_rest_and_transit"
      access_control: "need_to_know"
      audit_trail: "required"
 
  - name: "Business Sensitive"
    description: "Proprietary business information"
    criteria:
      - data_type: ["strategic_plan", "customer_list", "pricing", "source_code"]
    classification: "confidential"
    handling:
      encryption: "required_in_transit"
      access_control: "role_based"
      external_sharing: "restricted"
 
  - name: "Internal Operations"
    description: "Internal documents and communications"
    criteria:
      - internal_only: true
      - public_impact: "low"
    classification: "internal"
    handling:
      encryption: "recommended_in_transit"
      access_control: "employee_only"
 
  - name: "Default Public"
    description: "All other data"
    criteria:
      - default: true
    classification: "public"
    handling:
      encryption: "optional"
      access_control: "open"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154

// Enterprise Data Classification Service
// Combines pattern matching, ML inference, and policy rules
 
interface ClassificationResult {
  classification: ClassificationLevel;
  confidence: number;
  matchedRules: string[];
  dataTypes: string[];
  requiresReview: boolean;
}
 
enum ClassificationLevel {
  PUBLIC = 'public',
  INTERNAL = 'internal',
  CONFIDENTIAL = 'confidential',
  HIGHLY_CONFIDENTIAL = 'highly_confidential',
}
 
interface DetectedDataType {
  type: string;
  confidence: number;
  location: string;
  sample?: string; // Masked for logging
}
 
class DataClassificationService {
  private patternDetectors: PatternDetector[];
  private mlClassifier: MLClassificationModel;
  private policyEngine: PolicyEngine;
 
  constructor(config: ClassificationConfig) {
    this.patternDetectors = [
      new SSNDetector(),
      new CreditCardDetector(),
      new EmailDetector(),
      new PhoneNumberDetector(),
      new APIKeyDetector(),
      new PasswordPatternDetector(),
    ];
    this.mlClassifier = new MLClassificationModel(config.modelEndpoint);
    this.policyEngine = new PolicyEngine(config.policies);
  }
 
  async classifyData(
    content: string | Buffer,
    metadata: DataMetadata
  ): Promise<ClassificationResult> {
    // Layer 1: Pattern-based detection (fast, high-precision)
    const patternMatches = await this.runPatternDetection(content);
    
    // Layer 2: ML-based detection (comprehensive, moderate precision)
    const mlDetections = await this.mlClassifier.analyze(content);
    
    // Layer 3: Metadata analysis (schema, location, origin)
    const metadataSignals = this.analyzeMetadata(metadata);
    
    // Combine detections with deduplication
    const allDetections = this.mergeDetections(
      patternMatches,
      mlDetections,
      metadataSignals
    );
    
    // Apply policy rules to determine classification
    const classification = await this.policyEngine.evaluate(
      allDetections,
      metadata
    );
    
    // Flag low-confidence results for human review
    const requiresReview = 
      classification.confidence < 0.85 ||
      allDetections.some(d => d.confidence < 0.7);
    
    // Emit classification event for audit and monitoring
    await this.emitClassificationEvent({
      dataId: metadata.id,
      classification: classification.level,
      confidence: classification.confidence,
      timestamp: new Date(),
      requiresReview,
    });
    
    return {
      classification: classification.level,
      confidence: classification.confidence,
      matchedRules: classification.matchedRules,
      dataTypes: allDetections.map(d => d.type),
      requiresReview,
    };
  }
 
  private async runPatternDetection(
    content: string | Buffer
  ): Promise<DetectedDataType[]> {
    const results: DetectedDataType[] = [];
    const contentStr = content.toString();
    
    for (const detector of this.patternDetectors) {
      const matches = await detector.detect(contentStr);
      results.push(...matches.map(m => ({
        type: detector.dataType,
        confidence: 0.95, // Pattern matches have high confidence
        location: m.location,
        sample: this.maskSample(m.value),
      })));
    }
    
    return results;
  }
 
  private analyzeMetadata(metadata: DataMetadata): DetectedDataType[] {
    const signals: DetectedDataType[] = [];
    
    // Column/field name analysis
    const sensitiveNamePatterns = {
      'ssn': 'social_security_number',
      'password': 'credential',
      'secret': 'credential',
      'credit_card': 'payment_card',
      'salary': 'financial_data',
      'dob': 'personal_data',
      'birth': 'personal_data',
    };
    
    for (const [pattern, dataType] of Object.entries(sensitiveNamePatterns)) {
      if (metadata.fieldName?.toLowerCase().includes(pattern)) {
        signals.push({
          type: dataType,
          confidence: 0.8,
          location: `field:${metadata.fieldName}`,
        });
      }
    }
    
    // Source system analysis
    if (metadata.sourceSystem) {
      const systemClassifications = this.policyEngine
        .getSystemDefaultClassification(metadata.sourceSystem);
      if (systemClassifications) {
        signals.push(...systemClassifications);
      }
    }
    
    return signals;
  }
 
  private maskSample(value: string): string {
    // Never log actual sensitive data
    if (value.length <= 4) return '****';
    return value.substring(0, 2) + '*'.repeat(value.length - 4) + 
           value.substring(value.length - 2);
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

// Classification Governance Service
// Manages classification lifecycle with full audit trail
 
interface ClassificationChange {
  dataAssetId: string;
  previousClassification: ClassificationLevel;
  newClassification: ClassificationLevel;
  reason: string;
  justification: string;
  approver?: string;
  effectiveDate: Date;
}
 
interface ClassificationReview {
  dataAssetId: string;
  reviewer: string;
  reviewDate: Date;
  outcome: 'confirmed' | 'reclassification_needed' | 'escalated';
  notes: string;
  nextReviewDate: Date;
}
 
class ClassificationGovernanceService {
  private auditLog: AuditLogService;
  private notificationService: NotificationService;
  private approvalWorkflow: ApprovalWorkflowService;
 
  async requestReclassification(
    request: ReclassificationRequest
  ): Promise<ReclassificationResult> {
    // Validate requester authorization
    await this.validateRequesterAccess(request.requesterId, request.dataAssetId);
    
    const currentClassification = await this.getCurrentClassification(
      request.dataAssetId
    );
    
    // Determine if approval is required
    const requiresApproval = this.determineApprovalRequirement(
      currentClassification,
      request.newClassification
    );
    
    if (requiresApproval) {
      // Initiate approval workflow for classification changes
      const workflow = await this.approvalWorkflow.initiate({
        type: 'classification_change',
        dataAssetId: request.dataAssetId,
        currentState: currentClassification,
        requestedState: request.newClassification,
        justification: request.justification,
        requester: request.requesterId,
        approvers: await this.getRequiredApprovers(
          request.dataAssetId,
          currentClassification,
          request.newClassification
        ),
      });
      
      return {
        status: 'pending_approval',
        workflowId: workflow.id,
        estimatedCompletionTime: workflow.estimatedCompletionTime,
      };
    }
    
    // Apply classification change immediately for non-approval cases
    return this.applyClassificationChange({
      dataAssetId: request.dataAssetId,
      previousClassification: currentClassification,
      newClassification: request.newClassification,
      reason: 'owner_request',
      justification: request.justification,
      effectiveDate: new Date(),
    });
  }
 
  async conductPeriodicReview(
    dataAssetId: string,
    reviewerId: string
  ): Promise<ClassificationReview> {
    const asset = await this.getDataAsset(dataAssetId);
    const currentClassification = asset.classification;
    
    // Run automated classification check
    const automatedAssessment = await this.classificationService
      .assessCurrentClassification(dataAssetId);
    
    // Prepare review with automated findings
    const review: ClassificationReview = {
      dataAssetId,
      reviewer: reviewerId,
      reviewDate: new Date(),
      outcome: 'confirmed',
      notes: '',
      nextReviewDate: this.calculateNextReviewDate(currentClassification),
    };
    
    // Flag discrepancies for human review
    if (automatedAssessment.recommendedClassification !== currentClassification) {
      review.outcome = 'reclassification_needed';
      review.notes = `Automated assessment suggests ${automatedAssessment.recommendedClassification}. Current: ${currentClassification}. Reason: ${automatedAssessment.reasoning}`;
      
      await this.notificationService.notifyDataOwner(
        asset.ownerId,
        'classification_review_discrepancy',
        { dataAssetId, finding: review.notes }
      );
    }
    
    // Log review in audit trail
    await this.auditLog.log({
      event: 'classification_review',
      dataAssetId,
      reviewer: reviewerId,
      outcome: review.outcome,
      timestamp: review.reviewDate,
    });
    
    return review;
  }
 
  private determineApprovalRequirement(
    current: ClassificationLevel,
    requested: ClassificationLevel
  ): boolean {
    // Downgrading always requires approval
    if (this.classificationOrdinal(requested) < this.classificationOrdinal(current)) {
      return true;
    }
    // Upgrading to highest level requires verification
    if (requested === ClassificationLevel.HIGHLY_CONFIDENTIAL) {
      return true;
    }
    return false;
  }
 
  private classificationOrdinal(level: ClassificationLevel): number {
    const order = {
      [ClassificationLevel.PUBLIC]: 0,
      [ClassificationLevel.INTERNAL]: 1,
      [ClassificationLevel.CONFIDENTIAL]: 2,
      [ClassificationLevel.HIGHLY_CONFIDENTIAL]: 3,
    };
    return order[level];
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

// Classification-Aware Data Access Layer
// Enforces classification policies on all data operations
 
interface DataAccessContext {
  userId: string;
  userRole: string;
  userClearance: ClassificationLevel;
  accessReason: string;
  requestId: string;
}
 
class ClassificationAwareRepository<T> {
  private baseRepository: Repository<T>;
  private policyEngine: ClassificationPolicyEngine;
  private auditLogger: DataAccessAuditLogger;
  private maskingService: DataMaskingService;
 
  async findById(
    id: string,
    context: DataAccessContext
  ): Promise<T | null> {
    const record = await this.baseRepository.findById(id);
    if (!record) return null;
    
    const classification = await this.getRecordClassification(record);
    
    // Check access authorization
    const accessDecision = await this.policyEngine.evaluateAccess({
      requester: context,
      resource: { id, classification },
      operation: 'read',
    });
    
    if (!accessDecision.allowed) {
      await this.auditLogger.logDeniedAccess({
        userId: context.userId,
        resourceId: id,
        classification,
        reason: accessDecision.reason,
        timestamp: new Date(),
      });
      throw new AccessDeniedError(
        `Access denied to ${classification} data: ${accessDecision.reason}`
      );
    }
    
    // Apply masking based on clearance level delta
    const maskedRecord = await this.applyAppropriateeMasking(
      record,
      classification,
      context.userClearance
    );
    
    // Log successful access for audit trail
    await this.auditLogger.logDataAccess({
      userId: context.userId,
      resourceId: id,
      classification,
      operation: 'read',
      masked: maskedRecord !== record,
      timestamp: new Date(),
      requestId: context.requestId,
    });
    
    return maskedRecord;
  }
 
  private async applyAppropriateeMasking(
    record: T,
    resourceClassification: ClassificationLevel,
    userClearance: ClassificationLevel
  ): Promise<T> {
    // Users with matching or higher clearance see unmasked data
    if (this.classificationOrdinal(userClearance) >= 
        this.classificationOrdinal(resourceClassification)) {
      return record;
    }
    
    // Apply field-level masking based on classification delta
    return this.maskingService.applyMasking(record, {
      resourceClassification,
      viewerClearance: userClearance,
    });
  }
 
  async query(
    criteria: QueryCriteria,
    context: DataAccessContext
  ): Promise<T[]> {
    // Add classification filter to prevent returning inaccessible records
    const classificationFilter = this.buildClassificationFilter(
      context.userClearance
    );
    
    const enhancedCriteria = {
      ...criteria,
      filters: [...(criteria.filters || []), classificationFilter],
    };
    
    const results = await this.baseRepository.query(enhancedCriteria);
    
    // Log bulk access
    await this.auditLogger.logBulkAccess({
      userId: context.userId,
      query: this.sanitizeQueryForLogging(criteria),
      resultCount: results.length,
      timestamp: new Date(),
      requestId: context.requestId,
    });
    
    return results;
  }
 
  private buildClassificationFilter(
    userClearance: ClassificationLevel
  ): QueryFilter {
    // Return only records at or below user's clearance level
    const accessibleLevels = this.getAccessibleLevels(userClearance);
    return {
      field: 'classification',
      operator: 'in',
      value: accessibleLevels,
    };
  }
}