Scanning for Personally Identifiable Information (PII)

The contract for the Spirion (formerly Identity Finder) product will not be renewed. UD-IT Security recommends that clients review their data periodically to remove unneeded PII and to encrypt remaining data with PII. We recommend the following action to detect and remove PII from UD systems

 

Clear or archive any old or unused files.

Depending on data lifecycle policies for your data, remove or archive files that are not actively in use. Please remember to encrypt archives to ensure protection for data-at-rest.

 

Migrate files to approved cloud network storage locations and use native search and discovery tools in those platforms.

GSuite and Office 365 are commonly used in the University.  Please make sure you are using your UD id and password for access. If not you may be using network storage that is not approved for University usage. Contact your IT Pro if you are not sure that you are using the University instances for cloud storage.  

Notes: 

  • All the products feature prominent search boxes in their interfaces that can be used to look for specific PII data or keywords. Specific syntax for queries is included in the help documentation on each platform.

  • File server and share storage locations are generally limited to a department and already have guidance for PII storage and detection.

 

Ensure OS encryption tools are properly installed and configured.

Use OS native tools for searches to ensure data uses the encrypted storage locations. Please contact your IT Pro, if you need help using these OS features. Common examples have been provided below however this is not an exhaustive list of options

  • Bitlocker and Windows Search

  • FileVault and Spotlight

  • LUKS  and grep

 

Use free search tools