ACTIVITIES SENSITIVE DATA Summary Data and meta-data about an organization and its staff is incredibly difficult to keep track of over time, as people or projects use cloud services like Dropbox or Google Drive for some activities, a shared server for others, and a mix of work and personal devices (laptops, phones, tablets...). This is natural, but it is important to keep track of where your organization's data lives and who can access it. Overview With staff input, post up popular places where data is kept (laptops, email, shared drives...) Using stickies, gather from the staff what data is kept in what locations - duplicating notes when needed Rank data by sensitivity Discuss the impact of one of the devices where data is stored being lost - are there backups? Discuss the impact of a device being exposed / taken by an adversary Identify who has access (physical access, login access, and permissions), and who needs to have access to get the organizations work completed. Materials Needed Stickies and markers for activities Flip chart paper or a whiteboard Camera to record outputs digitally Considerations Some of the stickies generated in this activity may provide sensitive data, dispose of them responsibly. If you take photos for reporting needs, save the image files in a secure, encrypted container. Page 105 of 240