Using Cornell’s Spider to scan for sensitive information January 27, 2009 Steve Lovaas, ACNS Colorado State University

Spider, the Tool What is it Where to get it Where to use it Which version Installing Changing defaults Running Logging Remediation Reporting Demo Q&A

What is Spider (a refresher moment) Developed by Wyman Miles  Cornell University Open source, CSU collaboration Searches directories, opening files  Reads them if possible Regular-expression matching

Where to get it Supporting documents, config files Local download of application Link to online documentation Reporting template, exception request

Where to use it Easiest to configure on one machine, scan across the network.NET 2.0 or greater for Windows versions Mac and Linux versions available  …but better ones are coming soon Scan from a Windows machine

Which version Spider 2.9, 3, or is stable and recommended 2008 has some very useful features, still beta

Installing.NET 2.0 (or greater) first Zipped installer Spider 3 installs EXE Spider 2008 installs MSI Final Spider 2008 will include web config updater

Changing defaults Spider 3 scans everything Spider 2008 scans a list of file types Can exclude directories to improve performance (and maybe miss) Leave default CC# regexes CSU SSN regex (based on CMU’s).reg file to set config

Running Can take a lot of resources Spider 2008 can recover from interruption (with 3, you’ll have to start over)

Logging Spider 3  local log file (password if includes the hits)  syslog/Windows Event Log Spider 2008  encrypted State Database, exportable logs  syslog/Windows Event Log Protect your logs!

Remediation Spider 3  a manual event Spider 2008  redact (XXXX) SSNs/CC#s in files  right-click-and-delete from the log screen Re-scan after user remediation

Reporting Spider 3:  a manual event (or some custom scripts) Spider 2008  log export tool ACNS doesn’t want the logs, but you might want to burn them to disk for archive Summarize results on the report template (Excel)

Demo of each version…

Questions?