The University of Nebraska is implementing Identity Finder as an important data loss prevention initiative to discover any Social Security Number data that needs eliminated or protected.
The Identity Finder Software will be configured to run on your computer on a weekly basis to search for Social Security Number data. It will result in a report that shows your filenames and parts of those files that have data that looks like an SSN. The software lets you securely shred files that are no longer needed, ignore false positives or scrub/redact the SSN’s from the file but keep the rest of the data in the file.
Why is it important to use Identity Finder? A data loss prevention program ensures sensitive and confidential information is fully and properly managed. This product allows us to conduct data discovery throughout the university system including workstations for restricted data to avoid the risk of a breach. The University of Nebraska Central Administration has licensed this for all campus faculty and staff, so it’s imperative to take advantage of the resources spent to protect our constituents. This is a university wide effort to reduce our risk of exposure. President Bounds is very supportive of this important security measure and he and his colleagues in Varner Hall were among the early adopters of the software. Progress of the implementation will be reported to the Dean’s Counsel and the Chancellor’s cabinet on a regular basis. Identity Finder is used at over 500 higher education institutions. It is very easy to use.
If you think a breach won’t happen to you, think again. 10% of phishing scams lead to a data breach and are combined with malicious software. 30% of phishing emails are opened and 12% of end users click the link or open the attachment. Most phishing attacks are a means to install persistent malware to steal credentials to use for further attacks. –Verizon 2016 Data Breach Report
Some people are surprised when they learn they have SSN data on their computers. A lot of data gets handed down from person to person as turnover occurs in positions. It may no longer be used today but it sits on computers and is vulnerable to a breach. Faculty may have old spreadsheets of SSNs and grades used prior to introduction of the NUID identification number and have forgotten the spreadsheets exist. We need to clean up such data to reduce the university’s risk of data loss. Our students entrust us with their information and the responsibility to protect that information rests on all of us.
How to use it? Contact the Helpdesk at firstname.lastname@example.org or your technology coordinator to request installation. Once the installer completes it will begin a system search.
The first search may take several hours to complete but it will run in the background with a low priority level so it should not impact your machine’s performance. After the initial scan, subsequent scans only search files that have changed so it will run much faster. The status window can be shown at any time during a scan to check on progress. Right click on the icon and select Show Status Window.
When finished the Results Wizard will appear and guide you through looking at each file, one at a time.
Upon completion of a scan, Identity Finder will present a report of all SSN data found with options to electronically Shred (delete), Scrub (redact), or Ignore the data. You must review and remediate all results – meaning they must be removed, replaced or moved.
IF YOU MUST USE SSN TO DO YOUR JOB, YOU MUST REQUEST A SSN EXEMPTION VIA UNK’S SSN EXEMPTION PROCESS. Instructions are located here.
Your options for each file include:
Shred – utilizes US Department of Defense standard DOD 5220.22-M data sanitation method to securely delete files. Shred permanently deletes the files containing SSN securely if the files are no longer needed. WARNING: Files removed with the Shred action are unrecoverable. Be sure the files you shred are no longer needed.
Scrub – also known as redact, removes personal information from inside a file. It is only available for specific file types, and is not recommended to use on databases. This should be used if the file is still needed but the SSN’s are not. WARNING: Using this option will replace every character of the SSN with an X and cannot be undone.