Data Classification and Handling

Data Classification and Handling

MANDATORY WORKSHOP

This workshop is mandatory for all users storing research data on the Sagehen HPC cluster. Completion of this workshop is required before your research computing account can be fully activated.

Why This Workshop Matters

Research data is one of Pomona College’s most valuable and sensitive assets. Every day, researchers on Sagehen store data ranging from public course materials to export-controlled research findings, from published papers to students’ confidential grades. The way we handle this data (who can access it, how we store it, how we share it) determines whether we comply with federal regulations, protect research integrity, and safeguard our community.

This workshop teaches you Pomona’s three-tier data classification system and the specific security controls required for each tier. By the end of this workshop, you’ll be able to:

  • Classify your research data correctly
  • Understand the handling requirements for each classification level
  • Store data securely on Sagehen with appropriate encryption and access controls
  • Share data with collaborators while maintaining compliance
  • Recognize and report data security incidents
Prerequisite

Prerequisites

This workshop assumes you have: - Basic knowledge of HPC cluster usage (Workshop 01: HPC Cluster Basics) - An active Sagehen account and can log in via SSH (Workshop 02: Account Setup and Login) - Basic familiarity with Linux file permissions and command-line tools

If you’re new to Pomona’s HPC cluster, please complete Workshops 01 and 02 first.

What You’ll Learn

Episode Focus
01 - Why Classify Data? The business case, compliance landscape, and real-world consequences of data breaches
02 - Three Tiers Detailed classification system: Public, Proprietary, Restricted
03 - Classifying Your Data Decision tree and scenarios to classify your own research data
04 - Handling Requirements Access controls, audit requirements, and retention policies per tier
05 - Storage and Encryption Sagehen storage options, encryption tools (gocryptfs), file permissions
06 - Sharing and Collaboration Sharing with collaborators, external transfers, publishing, de-identification

Key Facts About Data Classification at Pomona

  • Three tiers (Public, Proprietary, Restricted) with increasing security requirements
  • Public data can be fully public or shared freely within lab groups
  • Restricted data requires encryption using gocryptfs (AES-256-GCM) before storage on Sagehen
  • Your PI is responsible for classifying data before it goes on the cluster
  • Violations can result in data loss, incident response, loss of computing privileges, or legal action
  • Incident reporting: Email if you suspect a data breach

About This Workshop

  • Duration: about 7.5 hours (typically delivered in 2 sessions)
  • Prerequisites: HPC Cluster Basics (Workshop 1), Account Setup and Login (Workshop 2)
  • Format: Carpentries Workbench with hands-on exercises
  • Instructor: Andrew Wilson, Director of Research Computing, Pomona College ITS
  • Contact:

Compliance Frameworks

This workshop ensures your compliance with:

  • NIST SP 800-171: Safeguarding controlled unclassified information (CUI)
  • FERPA: Family Educational Rights and Privacy Act for student records
  • EAR/ITAR: Export control for research with military/dual-use implications
  • Pomona Information Security Policy: Institutional data protection standards
  • Pomona HPC Usage Policy: Cluster-specific security requirements

How to Use This Workshop

  1. Work through episodes in order: Each builds on the previous one
  2. Classify your own data: Use Episode 03’s decision tree with your research datasets
  3. Implement controls: Apply Episode 05’s guidance to your current storage
  4. Document your decisions: Keep records of classification decisions for audit purposes
  5. Ask questions: Reach out to if anything is unclear

Storage Quick Reference

Classification Location Encryption Access Permissions Typical Data
Public /rhome or /bigdata Not required Anyone/group 755 or 750 Published papers, course materials, lab notebooks
Proprietary /rhome or /bigdata Recommended Restricted 750 or 600 Grant proposals, personnel data, unpublished research
Restricted /rhome or /bigdata Required (gocryptfs) Specific users 700+gocryptfs Student records, CUI, PII, EAR/ITAR, health data

Important Policies and Documents

Before taking this workshop, familiarize yourself with:

Ready to get started? Begin with Episode 01: Why Classification Matters

Questions? Contact Andrew Wilson at or visit ITS during office hours.

Acknowledgments

Developed by Andrew Wilson, Director of Research Computing and Digital Scholarship at Pomona College, with Andrei Motchenko, who tested, edited and produced screenshots for the workshop series.

Pre-Workshop Preparation

This workshop teaches you how to classify research data and implement appropriate security measures on the Sagehen HPC cluster. Before attending, please complete the following preparation steps to get the most out of the session.

Required Reading (30 minutes)

Before the workshop, please read Pomona College’s Data Classification and Handling Policy. This short guide establishes the framework we’ll use throughout the workshop.

Download: Pomona College Data Classification Policy - Location: This should be provided by your HPC team or accessible via the college intranet - Key sections to review: - Three-tier classification system (Public, Proprietary, Restricted) - Your role and responsibility in protecting data - Consequences of data breaches - When and how to escalate security concerns

Note: The current system uses three tiers. If you see references to “Internal” or a four-tier system, these have been consolidated into the three-tier system where Internal shared data is now classified as PUBLIC.

If you haven’t received the policy document, contact before the workshop.

Reflect on Your Own Data (15 minutes)

Think about the data in your current research and answer these questions (write them down; don’t worry about accuracy):

  1. What types of data do you work with?
    • Examples: code, raw measurements, student information, survey responses, health records, proprietary algorithms, published data
  2. Is any of your data sensitive? Why?
    • Does it contain personal information (names, IDs, emails)?
    • Could it harm someone if leaked?
    • Is it confidential (proprietary, pre-publication)?
    • Does it require regulatory protection (FERPA, HIPAA, etc.)?
  3. How is your data currently stored?
    • Location: laptop, external drive, lab server, cloud service, Sagehen?
    • Who has access?
    • Is it encrypted?
  4. Have you ever misclassified or mishandled data? (honestly!)
    • Sent confidential files via unencrypted email?
    • Shared lab data with collaborators without permission?
    • Stored sensitive data on insecure systems?

You’ll share some reflections during the workshop (no need to share the sensitive details!). This helps us understand your starting point.

Review Example Datasets (20 minutes)

Your instructor will provide 3-4 example datasets before the workshop. For each dataset, try to classify it:

Dataset Example 1: CSV file with student survey responses - Contains: Column headers (name, email, age, department, response to Q1, response to Q2, etc.) - Ask yourself: Should this be Public? Proprietary? Restricted? - Why?

Dataset Example 2: Published research code on GitHub - Contains: Source code for a published paper, with inline comments, no secrets - Ask yourself: What tier? - Why?

Dataset Example 3: Raw experimental data - Contains: Measurements from a lab instrument, timestamps, no identifiers, proprietary method - Ask yourself: What tier? - Why?

Dataset Example 4: Genetic sequence data from human subjects - Contains: Participant IDs, DNA sequences, phenotype data, recruited via a study - Ask yourself: What tier? - Why?

You don’t need to get these right; the goal is to start thinking about classification. We’ll discuss answers during the workshop.

If you have Linux or macOS, try installing and testing gocryptfs, a tool for encrypting files. This is optional but recommended so you’re not learning encryption for the first time in the workshop.

Install gocryptfs

macOS (via Homebrew):

BASH 

brew install gocryptfs

Linux (Debian/Ubuntu):

BASH 

sudo apt-get install gocryptfs

Windows: - Not natively supported, but you can use Windows Subsystem for Linux (WSL) - Or use VeraCrypt for encryption instead

Test gocryptfs (Quick Tutorial)

BASH 

# Create an encrypted folder
mkdir ~/encrypted_vault_storage ~/encrypted_vault_mount

# Initialize gocryptfs
gocryptfs -init ~/encrypted_vault_storage

# You'll be asked for a password; remember it!

# Mount the encrypted folder
gocryptfs ~/encrypted_vault_storage ~/encrypted_vault_mount

# Create a test file
echo "Secret data" > ~/encrypted_vault_mount/secret.txt

# Verify it's encrypted (look at storage folder):
ls ~/encrypted_vault_storage/
# You'll see cryptic filenames, not "secret.txt"

# Unmount when done
fusermount -u ~/encrypted_vault_mount
# Or on macOS: umount ~/encrypted_vault_mount

This gives you hands-on experience with encryption before the workshop.

Access to Sagehen (Verify)

Confirm that you have access to Sagehen and the necessary directories:

  1. SSH into Sagehen:

    BASH 

    ssh your.<myusername>@sagehen.hpc.pomona.edu

  2. Check your home directory:

    BASH 

    pwd
ls -la /rhome/<myusername>/

  3. Verify you can access /bigdata/ (lab storage):

    BASH 

    ls -la /bigdata/
ls -la /bigdata/lab/<labname>/

  4. Check OnDemand access:

If you encounter any access issues, contact at least 3 days before the workshop.

Gather Example Datasets (Optional)

If you have real data from your research that you’re comfortable discussing, consider bringing a few examples to the workshop. You can use them in case studies and discussions.

What to bring: - A description of the dataset (type, size, source) - Key metadata (does it contain PII, proprietary info, etc.?) - Current storage location and access controls

For privacy: You don’t need to share the actual data, just describe it. If your data is highly sensitive, we can discuss it privately with the instructor after the workshop.

Understand Your Role

Before the workshop, clarify your role in data management:

  • Researcher/Faculty: You’re responsible for classifying your data and directing team members on proper handling
  • Graduate Student/Postdoc: You handle data day-to-day; you need to know classification requirements and how to implement them
  • Undergraduate/Lab Assistant: You work with data under supervision; you need to know your PI’s data policy and follow it
  • Lab Manager/Administrator: You manage lab data systems and policies; you’re responsible for compliance and training
  • IT Professional: You implement technical controls and support users; you need deep understanding of encryption and access control

During the workshop, the instructor will tailor examples to your role.

System Requirements

To participate fully in hands-on activities, have:

  • Computer with Windows, macOS, or Linux
  • Stable internet connection
  • SSH client (PuTTY, Terminal, or Git Bash; see Workshop 12 setup if needed)
  • ~1 GB of free disk space
  • Optional: gocryptfs or similar encryption tool installed

Helpful Resources

Troubleshooting Pre-Workshop Issues

Can’t access Sagehen? - Verify you’re on Pomona network or VPN - Check credentials with

Can’t install gocryptfs? - Installation is optional; we’ll demo it in the workshop - No need to troubleshoot before the workshop

Didn’t receive example datasets? - Email to request them - Or ask your supervisor to share examples from your lab’s work

Questions about the policy? - These will be addressed in Episode 1 of the workshop - Feel free to ask during the workshop Q&A

What to Expect

This workshop covers:

  1. Why data classification matters (business, legal, ethical drivers)
  2. The three-tier system (Public, Proprietary, Restricted)
  3. Classifying your own data (hands-on practice)
  4. Handling requirements per tier (technical and procedural)
  5. Encryption with gocryptfs (practical demo)
  6. Sharing and collaboration (safely)

You’ll leave with: - Clear understanding of where your data fits - Practical tools and techniques to protect it - Knowledge of when to ask for help - Confidence in Sagehen HPC’s security measures

No prior security expertise is required. Come with curiosity and a willingness to think carefully about data protection.