Public, Private, or Secret? Sorting Information to Stay Safe Online
In 2013, hackers broke into Target's computer systems and stole credit and debit card numbers from 40 million shoppers during the holiday season. Part of the damage happened because not all of Target's data was protected the same way. Cybersecurity experts sort information into different security levels - a process called classification - so the most sensitive information gets the strongest locks.
What You'll Learn
- Name the four common levels of data classification - Give an example of information at each level - Explain why not all data needs the same protection - Describe one rule for handling confidential information
The Four Levels of Data Classification
Most organizations sort information into four buckets. Public information is safe for anyone to see, like a school's website homepage. Internal information is meant only for people inside an organization, like a staff meeting schedule. Confidential information could hurt someone if it leaked, like a student's grades or medical records. Restricted (sometimes called "top secret") information is the most protected, like a hospital's full list of patient Social Security numbers or a company's unreleased product designs.
Why Classification Matters
If every piece of information got the exact same lock, companies would waste money protecting a lunch menu as tightly as a bank account number - and they might not spend enough protecting the truly sensitive stuff. By classifying data, IT teams decide who is allowed to see it, how it's stored, and how long it's kept. For example, confidential medical records might require two-factor authentication (a password plus a phone code), while a public flyer needs no lock at all.
Real-World Example: Your Own Data
Think about your own information. Your favorite color is basically public - it's not risky if someone knows it. Your home address is more private - you wouldn't post it publicly online. Your family's bank account number is confidential - only trusted people should ever see it. Cybersecurity workers use this same thinking, just applied to entire organizations with millions of records.
Never type a password, PIN, or Social Security number into a website unless you're certain it's the real, secure site. Scammers build fake copies of real websites just to trick people into typing in restricted information.
Which type of information would most likely be classified as "Restricted"?
Why don't companies protect every piece of data with the same maximum security?
Classify Your Classroom
List five pieces of information from your school (like the cafeteria menu, a friend's home address, the principal's email, a test answer key, and the school mascot). Sort each one into Public, Internal, Confidential, or Restricted, and write one sentence explaining your choice for two of them.
Want to keep learning?
Sign up for free to access the full curriculum — all subjects, all ages.
Start Learning Free