Principles for the Secure Exchange of Sensitive Data Across Classified Networks: A Data-Centric Approach

The internet of things, social media and other technological developments have a created a situation in which more and more sensitive data is being exchanged between government and semi-government organizations. However, sharing confidential data presents complex challenges that are not only confined to technological factors but are also inclusive of social aspects such as data governance. This article therefore promotes a data-centric approach to data exchange, deriving principles for the secure exchange of government data across confidential networks. Due to the potential advantages that data-driven decision-making brings to government organizations, significant pressure is often placed on government organizations to publish and exchange classified data or privacy sensitive data with cooperating government organizations or even with allied countries across classified networks. For example, it is often difficult to assess the confidentiality of raw data. Furthermore, data leaks and ransoming of data have become a common occurrence which often have wide-ranging and unforeseen consequences. More and more, government organizations are looking beyond traditional security methods towards a more data-centric approach, whereby data is positioned at the foundation of decision-making and operations regarding risk management. This approach acts as a means to gain control over the secure exchange of confidential and sensitive data so that the right people continue to have access to the right data at the right time whilst simultaneously ensuring that the wrong people do not gain access to confidential data. However, secure data exchange viewed from a data-centric perspective has been given little attention to date. This article outlines a systematic review of literature on data-centric approaches to data exchange. The findings show that along with the technical aspects of data exchange, aspects such as data governance as well as the management of data as a product are also of importance to the secure and trusted exchange of sensitive data.