Well we learned that Information Security is the practice of protecting data, now we need to decide what data do we need to protect. Every organization will answer this question differently. Are you a medical company, do you have patient data? Maybe you are a manufacturing company so your data could be plans, or recipe’s of how you make your product. How about your employee information, personal data, every company has employee’s so maybe we need to protect that type of information too. There is a lot of different types of data that we need to protect based on what industry we are in.
Once you figure out what kind of data you want to protect now you need to figure out where this data resides on your network. Defining what is in scope for a security effort is a very difficult part of a security plan. Think of all the places where this sensitive data could be. Databases, file servers, web apps, or maybe the cloud.
Think of a grocery store, all the food is organized into aisles and shelves. We need to do the same thing with our data in our enterprise. What if you walked into the grocery store and all the food was in a big pile in the middle of the store. How would you find the items you need? How long would it take to find your list of ingredients you need to pick up. If our data is scattered amongst our network that is the same thing. Where is my sensitive data, and what kind do I have.
Figuring out what kind of sensitive data we have and where it resides is one of the most challenging infosec practices. If we know what we have and where it lives we are better suited to protect our sensitive data.