Skip to content

Purpose and Scope

This document details the process for handling Strictly Confidential Information (SCI), steps involved in tagging Kafka topics associated with SCI data, and essential recommendations regarding client-side encryption.

Description of Strictly Confidential Information (SCI)

Strictly Confidential Information (SCI) is data that, if misused, incorrectly distributed, or disclosed, could cause critical harm to Novo Nordisk (NN). For further information on SCI, see Handling-of-Strictly-Confidential-Data.

How to do SCI Tagging for a Topic

To tag a Kafka topic as Strictly Confidential, utilize the Data Product Pipeline and include the DC_Strictly_Confidential tag in the topic's metadata. Detailed instructions are in the Operation-Guide.

Tagging Example

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
  "$schema": "../../config-schemas/topic_schema.json", 
  "pilot_topic_metadata": { 
    "metadata": { 
      "tags": ["DC_Strictly_Confidential"], // Mandatory tag for SCI
      "business_metadata": [ 
        {
          "name": "Sourcecontrol",
          "attributes": {
            "url": "example",
            "repo": "example"
          }
        }
      ]
    }
  }
}

When tagging Kafka topics with the Strictly Confidential Information (SCI) classification, observe the following key considerations:

  • Consistency is Key: The SCI tag (DC_Strictly_Confidential) must be consistent across all environments (e.g., Dev, Tst, QA, Prod) and all Kafka clusters that host the topic.
  • Event Processing Flow: When using tool such as Flink, are used to process data from an SCI-tagged topic, any new topics or streams generated as a result of this processing must also be tagged with SCI. This ensures classification integrity throughout the data lifecycle.
  • Onboarding Documentation: Always refer to the detailed considerations and requirements captured in the official onboarding documentation specific to the KaaS platform for comprehensive guidance.

Client-Side Encryption

GIS Recommendation and Implications

The Global Information Security (GIS) team suggests considering encrypting data on the source side prior to publishing it to KaaS topics. While this provides maximum data isolation, it introduces significant operational implications that the data owner (project) must manage:

Implication Description
UI Readability You would not be able to read the data directly on the Confluent UI (Control Center) as it remains encrypted.
Stream Processing You would not be able to use Flink or other native KaaS stream processors to analyze or transform the data directly.
Key Management The handling of encryption keys is completely outside the scope of KaaS. This responsibility must be owned and managed by the data owner (project).
Key Sharing The data owner is responsible for establishing how encryption keys are securely shared with consumers and how those consumers decrypt the data.
Risk Assessment The risk assessment related to key management and the client-side encryption process is outside KaaS's scope and must be performed by the data owner.

Important Note: This source-side encryption is a security suggestion by GIS. Publishing unencrypted SCI data or encrypted SCI data to KaaS is permissible because the platform has been officially approved for handling SCI, provided all platform-level security controls (access, storage encryption, etc.) are implemented and adhered to.