Classification Policy

graph TD
    subgraph Classification["🏷️ Classification Tiers"]
        RESTRICTED["🔴 RESTRICTED<br/>Extreme Confidentiality<br/>National Security Level"]
        CONFIDENTIAL["🟠 CONFIDENTIAL<br/>High Confidentiality<br/>Business Sensitive"]
        INTERNAL["🟡 INTERNAL<br/>Moderate Confidentiality<br/>Company Use Only"]
        PUBLIC["🟢 PUBLIC<br/>No Confidentiality<br/>Publicly Accessible"]
    end
    
    subgraph CIA["🛡️ CIA Triad Mapping"]
        CONF["🔒 Confidentiality<br/>Data Secrecy"]
        INT["✅ Integrity<br/>Data Accuracy"]
        AVAIL["⏱️ Availability<br/>Data Access"]
    end
    
    subgraph Controls["🔐 Security Controls"]
        ENCRYPTION["🔐 Encryption Requirements"]
        ACCESS["🚪 Access Controls"]
        AUDIT["📊 Audit Logging"]
        RETENTION["📅 Retention Policy"]
    end
    
    RESTRICTED --> CONF
    RESTRICTED --> INT
    RESTRICTED --> AVAIL
    
    CONFIDENTIAL --> CONF
    CONFIDENTIAL --> INT
    CONFIDENTIAL --> AVAIL
    
    INTERNAL --> INT
    INTERNAL --> AVAIL
    
    PUBLIC --> AVAIL
    
    CONF --> ENCRYPTION
    CONF --> ACCESS
    INT --> AUDIT
    AVAIL --> RETENTION
    
    style Classification fill:#1565C0
    style CIA fill:#4CAF50
    style Controls fill:#FF9800

/**
 * CLASSIFICATION: RESTRICTED
 * Contains database credentials - never log or expose
 * 
 * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md">Classification Policy</a>
 * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md">Cryptography Policy</a>
 */
@Configuration
public class DatabaseConfig {
    
    // RESTRICTED: Database password from encrypted secrets manager
    @Value("${spring.datasource.password}")
    private String databasePassword;
    
    @Bean
    public DataSource dataSource() {
        HikariConfig config = new HikariConfig();
        config.setJdbcUrl(System.getenv("DB_URL"));
        config.setUsername(System.getenv("DB_USERNAME"));
        
        // NEVER log or print RESTRICTED data
        config.setPassword(databasePassword);
        
        // Enable connection encryption (TLS 1.3)
        config.addDataSourceProperty("ssl", "true");
        config.addDataSourceProperty("sslmode", "verify-full");
        
        return new HikariDataSource(config);
    }
    
    @Override
    public String toString() {
        return "DatabaseConfig{password=***REDACTED***}";
    }
}

/**
 * CLASSIFICATION: CONFIDENTIAL
 * Contains business-sensitive political party financial data
 * 
 * Access restricted to authenticated users with PARTY_ANALYST role
 * All access logged per ISO 27001 A.8.15
 */
@Entity
@Table(name = "party_financial_record")
public class PartyFinancialRecord {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(name = "party_id", nullable = false)
    private String partyId;
    
    // CONFIDENTIAL: Detailed budget breakdown
    @Column(name = "budget_json", columnDefinition = "jsonb")
    @Convert(converter = JsonConverter.class)
    private Map<String, BigDecimal> detailedBudget;
    
    @Column(name = "fiscal_year")
    private Integer fiscalYear;
    
    @CreatedDate
    @Column(name = "created_at", nullable = false)
    private LocalDateTime createdAt;
    
    @CreatedBy
    @Column(name = "created_by")
    private String createdBy;
}

@Service
public class PartyFinancialService {
    
    private final AuditLogger auditLogger;
    
    @PreAuthorize("hasRole('PARTY_ANALYST') or hasRole('ADMIN')")
    @Audited(message = "Access to CONFIDENTIAL party financial data")
    public PartyFinancialRecord getFinancialRecord(Long recordId, String userId) {
        // Log access to CONFIDENTIAL data
        auditLogger.logDataAccess(
            "CONFIDENTIAL", 
            "party_financial_record", 
            recordId, 
            userId
        );
        
        return financialRepository.findById(recordId)
            .orElseThrow(() -> new ResourceNotFoundException("Record not found"));
    }
}

/**
 * CLASSIFICATION: INTERNAL
 * System performance metrics for internal monitoring
 * 
 * Access requires authentication
 */
@Entity
@Table(name = "system_metrics")
public class SystemMetrics {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(name = "metric_name")
    private String metricName;
    
    @Column(name = "metric_value")
    private Double metricValue;
    
    @Column(name = "timestamp")
    private LocalDateTime timestamp;
    
    @Column(name = "server_id")
    private String serverId;
}

@RestController
@RequestMapping("/api/internal/metrics")
public class MetricsController {
    
    // INTERNAL: Requires authenticated user
    @GetMapping
    @PreAuthorize("isAuthenticated()")
    public ResponseEntity<List<SystemMetrics>> getMetrics(
            @RequestParam LocalDateTime startTime,
            @RequestParam LocalDateTime endTime) {
        
        List<SystemMetrics> metrics = metricsService.findByTimeRange(startTime, endTime);
        return ResponseEntity.ok(metrics);
    }
}

/**
 * CLASSIFICATION: PUBLIC
 * Published voting records from Swedish Riksdagen
 * 
 * Data already public via Riksdagen API
 * No access restrictions required
 */
@Entity
@Table(name = "voting_record")
public class VotingRecord {
    
    @Id
    private String votingId;
    
    @Column(name = "politician_id")
    private String politicianId;
    
    @Column(name = "vote")
    @Enumerated(EnumType.STRING)
    private VoteType voteType; // YES, NO, ABSTAIN, ABSENT
    
    @Column(name = "voting_date")
    private LocalDate votingDate;
    
    @Column(name = "document_id")
    private String documentId;
}

@RestController
@RequestMapping("/api/public/voting-records")
public class VotingRecordController {
    
    // PUBLIC: No authentication required
    @GetMapping
    public ResponseEntity<List<VotingRecord>> getVotingRecords(
            @RequestParam(required = false) String politicianId,
            @RequestParam(required = false) LocalDate startDate,
            @RequestParam(required = false) LocalDate endDate) {
        
        List<VotingRecord> records = votingService.findPublicRecords(
            politicianId, startDate, endDate
        );
        
        return ResponseEntity.ok(records);
    }
}

graph TD
    START["🏷️ Start Classification"] --> Q1{"Contains credentials,<br/>encryption keys,<br/>or PII?"}
    
    Q1 -->|Yes| RESTRICTED["🔴 RESTRICTED"]
    Q1 -->|No| Q2{Business-sensitive or<br/>competitive advantage<br/>if disclosed?}
    
    Q2 -->|Yes| Q3{Significant financial<br/>or legal impact<br/>if disclosed?}
    Q2 -->|No| Q4{Already publicly<br/>available or<br/>approved for release?}
    
    Q3 -->|Yes| CONFIDENTIAL["🟠 CONFIDENTIAL"]
    Q3 -->|No| INTERNAL["🟡 INTERNAL"]
    
    Q4 -->|Yes| PUBLIC["🟢 PUBLIC"]
    Q4 -->|No| INTERNAL
    
    RESTRICTED --> R_CONTROLS["🔐 Maximum Security:<br/>• AES-256 encryption<br/>• MFA required<br/>• Never log<br/>• Immediate disposal"]
    
    CONFIDENTIAL --> C_CONTROLS["🛡️ High Security:<br/>• Encryption recommended<br/>• RBAC enforced<br/>• Access logging<br/>• Quarterly reviews"]
    
    INTERNAL --> I_CONTROLS["🚪 Standard Security:<br/>• Authentication required<br/>• Internal use only<br/>• Standard retention<br/>• Basic logging"]
    
    PUBLIC --> P_CONTROLS["🌐 Public Access:<br/>• No restrictions<br/>• Integrity focus<br/>• High availability<br/>• Public distribution OK"]
    
    style RESTRICTED fill:#D32F2F
    style CONFIDENTIAL fill:#FF9800
    style INTERNAL fill:#FDD835
    style PUBLIC fill:#4CAF50
    style START fill:#1565C0

/**
 * CLASSIFICATION: RESTRICTED
 * 
 * Contains authentication tokens and encrypted credentials.
 * 
 * Security Requirements:
 * - Never log token values
 * - Rotate tokens every 90 days
 * - Immediate revocation on compromise
 * 
 * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md">Classification Policy</a>
 * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secrets_Management_Policy.md">Secrets Management</a>
 */
public class AuthenticationToken {
    // Implementation
}

-- CLASSIFICATION: CONFIDENTIAL
-- Party financial data with business-sensitive budget details
-- Access requires PARTY_ANALYST role
COMMENT ON TABLE party_financial_record IS 
'CLASSIFICATION: CONFIDENTIAL - Party financial data requiring access control';

COMMENT ON COLUMN party_financial_record.budget_json IS 
'Detailed budget breakdown - business sensitive';

---
title: Security Vulnerability Assessment
classification: CONFIDENTIAL
date: 2025-02-10
author: Security Team
retention: 7 years
---

# CONFIDENTIAL: Security Vulnerability Assessment

**Classification**: CONFIDENTIAL  
**Audience**: Internal Security Team Only  
**Distribution**: Do not forward externally

# CLASSIFICATION: INTERNAL
# Application configuration - internal use only
spring:
  application:
    name: citizen-intelligence-agency
  # ... configuration