classification-framework-enforcement

Classification Framework Enforcement Skill

Purpose

This skill ensures Black Trigram maintains comprehensive classification of all assets, data, and systems according to Hack23 AB's Classification & Business Continuity Framework. It enforces proper security levels, business impact analysis, recovery objectives, and project type classifications through systematic assessment and documentation.

Core Reference: Hack23 ISMS Classification Framework

When to Apply

Automatically trigger this skill when:

• Implementing new features or systems
• Handling sensitive data or user information
• Designing security controls or access restrictions
• Planning disaster recovery or business continuity
• Classifying project assets or repositories
• Conducting risk assessments or impact analysis
• Defining RTO/RPO requirements
• Reviewing architecture or data models
• Creating or updating security documentation

Core Principles

1. Security Classification Levels

ALWAYS classify assets across four security dimensions:

✅ Complete Security Classification Pattern

/**
 * Security classification for Black Trigram game assets and systems.
 * 
 * Based on Hack23 ISMS Classification Framework ensuring defense-in-depth
 * security posture aligned with CIA triad and privacy requirements.
 * 
 * @see {@link https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md}
 * @category Security
 * @korean 보안등급분류
// ... (see full reference in Hack23 ISMS)

2. Business Impact Analysis (BIA)

ALWAYS assess impact across four business dimensions:

✅ Business Impact Assessment Pattern

/**
 * Business impact analysis for security incidents or system failures.
 * 
 * Quantifies potential impact to financial, operational, reputational, and
 * regulatory domains following Hack23 BIA methodology.
 * 
 * @see {@link https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#business-impact-analysis-matrix}
 * @category Business Continuity
 * @korean 사업영향분석
// ... (see full reference in Hack23 ISMS)

3. Recovery Time Objectives (RTO/RPO)

ALWAYS define recovery requirements for critical systems:

✅ Recovery Objectives Pattern

/**
 * Recovery Time Objective (RTO) and Recovery Point Objective (RPO) classifications.
 * 
 * RTO: Maximum tolerable downtime before recovery must complete
 * RPO: Maximum tolerable data loss window
 * 
 * @see {@link https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#recovery-time-classifications}
 * @category Business Continuity
 * @korean 복구목표시간
// ... (see full reference in Hack23 ISMS)

4. Project Type Classification

ALWAYS classify projects by technical type and business process:

✅ Project Classification Pattern

/**
 * Project type classification for organizational taxonomy.
 * 
 * Classifies projects by technical architecture and business process
 * to enable consistent security controls and risk assessment.
 * 
 * @see {@link https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#project-type-classifications}
 * @category Organization
 * @korean 프로젝트분류
// ... (see full reference in Hack23 ISMS)

5. Defense-in-Depth Classification

ALWAYS implement layered security based on classification:

✅ Layered Security Controls Pattern

/**
 * Defense-in-depth security controls based on asset classification.
 * 
 * Maps security classification levels to specific technical controls
 * implementing multiple layers of protection.
 * 
 * @category Security
 * @korean 심층방어
 */
// ... (see full reference in Hack23 ISMS)

6. Korean Martial Arts Classification Context

Integrate Korean philosophy in classification approach:

✅ Korean Philosophy Classification Pattern

/**
 * Korean martial arts principles applied to information classification.
 * 
 * Maps Eight Trigram (팔괘) philosophy to defense-in-depth security layers,
 * demonstrating cultural authenticity in technical architecture.
 * 
 * @see {@link https://github.com/Hack23/blacktrigram/blob/main/game-design.md}
 * @category Korean Philosophy
 * @korean 팔괘보안원리
// ... (see full reference in Hack23 ISMS)

Enforcement Rules

Rule 1: All Assets Must Be Classified

IF (new asset OR system OR data type introduced)
THEN (create SecurityClassification with all four dimensions: confidentiality, integrity, availability, privacy)
ELSE (reject - incomplete classification)

Rule 2: Business Impact Analysis Required for Critical Assets

IF (asset confidentiality >= HIGH OR integrity >= HIGH OR availability >= HIGH)
THEN (conduct BusinessImpactAnalysis across financial, operational, reputational, regulatory)
ELSE (document why BIA not required)

Rule 3: Recovery Objectives Defined for High Availability

IF (availability >= HIGH OR integrity >= HIGH)
THEN (define RecoveryObjectives with RTO and RPO)
ELSE (document acceptable data loss and downtime)

Rule 4: Defense-in-Depth Controls Match Classification

IF (confidentiality level increases)
THEN (add preventive + detective + corrective + deterrent controls proportionally)
ELSE (reject - insufficient security controls for classification level)

Rule 5: Privacy Classification Follows GDPR Requirements

IF (handling personal data OR user information)
THEN (classify privacy level: Personal Identifier, Personal, or Special Category)
  AND (implement GDPR-compliant controls: consent, data subject rights, DPO notification)
ELSE (classify as NA or Anonymized with justification)

Rule 6: Classification Reviewed Quarterly

IF (classification.lastReviewed > 90 days ago)
THEN (re-assess classification and update controls)
ELSE (proceed with current classification)

Rule 7: Project Type Determines Baseline Security

IF (projectType === 'Security Tools' OR 'Compliance Platform' OR 'Banking Services')
THEN (baseline classification: High confidentiality, High integrity, High availability)
ELSE IF (projectType === 'Frontend Apps' OR 'Content Creation')
THEN (baseline classification: Low-Moderate confidentiality, Moderate integrity, Moderate availability)
ELSE (conduct individual assessment)

Anti-Patterns to REJECT

❌ Unclassified Assets

// BAD: No classification information
const combatSystem = {
  name: 'Combat System',
  // Missing classification!
};

// GOOD: Complete classification
const combatSystem: SecurityClassification = {
  asset: '3D Physics-Based Combat System',
// ... (see full reference in Hack23 ISMS)

❌ Single Dimension Classification

// BAD: Only confidentiality considered
const userSettings = {
  confidentiality: 'Low',
  // Missing integrity, availability, privacy!
};

// GOOD: All four dimensions classified
const userSettings: SecurityClassification = {
  asset: 'User Settings and Preferences',
// ... (see full reference in Hack23 ISMS)

❌ Missing Business Impact Analysis

// BAD: High availability system without BIA
const apiService: SecurityClassification = {
  asset: 'API Service',
  confidentiality: ConfidentialityLevel.HIGH,
  integrity: IntegrityLevel.HIGH,
  availability: AvailabilityLevel.HIGH,
  privacy: PrivacyLevel.PERSONAL,
  // Missing BIA for high-criticality system!
  justification: 'High availability required',
// ... (see full reference in Hack23 ISMS)

❌ Undefined Recovery Objectives

// BAD: High availability without RTO/RPO
const database = {
  availability: AvailabilityLevel.HIGH,
  // Missing RTO/RPO!
};

// GOOD: Explicit recovery objectives
const databaseRecovery: RecoveryObjectives = {
  system: 'Primary Database',
// ... (see full reference in Hack23 ISMS)

❌ Generic "Sensitive Data" Classification

// BAD: Vague classification
const userData = {
  type: 'Sensitive Data',
  // What kind? GDPR category?
};

// GOOD: Specific privacy classification
const userEmailClassification: SecurityClassification = {
  asset: 'User Email Address',
// ... (see full reference in Hack23 ISMS)

Required Patterns

✅ Complete Asset Classification

// ALWAYS classify all four security dimensions
interface AssetRegistry {
  readonly assets: Map<string, SecurityClassification>;
  
  registerAsset(asset: SecurityClassification): void;
  getAsset(assetName: string): SecurityClassification | undefined;
  getAssetsRequiringReview(): SecurityClassification[];
}

// ... (see full reference in Hack23 ISMS)

✅ BIA-Driven Architecture Decisions

## Architecture Decision: Static Site Hosting

### Business Impact Analysis

**Scenario**: Primary hosting platform (GitHub Pages) failure

**Financial Impact**: Low (<$500/day)
- No revenue loss (free educational project)
- Minimal recovery costs (automated deployment)
// ... (see full reference in Hack23 ISMS)

✅ Classification-Based Access Control

/**
 * Access control based on asset classification.
 * 
 * Implements role-based access control (RBAC) with classification-aware
 * authorization checks.
 */
interface ClassificationBasedAccessControl {
  readonly userRole: 'Developer' | 'User' | 'Anonymous';
  
// ... (see full reference in Hack23 ISMS)

Compliance Framework

ISO 27001:2022 Controls

This skill enforces ISO 27001:2022 controls through classification:

• A.5.12: Classification of information - All assets classified systematically
• A.5.13: Labelling of information - Clear classification labels applied
• A.5.14: Information transfer - Classification maintained during transfer
• A.8.6: Capacity management - Availability classification informs capacity planning
• A.8.9: Configuration management - Classification guides configuration standards
• A.17.1: Information security continuity - BIA and RTO/RPO defined
• **

---

Content truncated.