1. MANAGING PII WITH IDENTITY FINDER Paul Hanson IET-Data Center and Client Services University of California, Davis

2. Agenda  What is PII and where’s the value?  What is Identity Finder?  Alternative Solutions  What can Identity Finder Scan?  How does Identity Finder handle the results?  Identity Finder Architecture  Architecture Overview  Client UI  INI Files  Custom MSI  Architecture Overview  Management Console  IET DCCS Implementation  IET DCCS Architecture  Lessons Learned  Breaking News  Questions

3. What is PII and where’s the value?  Cybersecurity (UC Davis)  Massachusetts 201 CMR 17.00  Protected Health Information (PHI)  Health Insurance Portability and Accountability Act (HIPAA)  FACT Red Flag Rules  Incident Response  Sysadmins may not know the data is there.

4. What is Identity Finder  Identity Finder searches the deepest recesses of a computer to locate and secure data that is vulnerable to identity theft - even when you don’t know it exists. The information is then presented to you to permanently shred, quarantine to a secure location, or encrypt with a password. Source: http://www.identityfinder.com/Products/Identity_Finder.html  Primarily Supports Windows & Mac  Feature rich  Continuously improving

5. Alternative Solutions WindowsMac Linux/ Unix Virginia Tech Find_SSNs XXX Cornell Spider XXX PowerGREP ???

6. Identity Finder Architecture  Enterprise Client  Installed on the workstation/server & does the heavy lifting  Management Console ( Really just a reporting server )  Dedicated system running IIS w/MSSQL  OS Compatibility  Clients for Windows and Mac  Linux/Unix systems are scanned remotely

7. What can Identity Finder Scan?  Microsoft Office (Excel, PowerPoint, Word, and OneNote including 2007)  Adobe Acrobat PDF (including 9.x)  Cookies and instant messenger logs  HTML files (htm, asp, js, etc.)  Text files (ANSI, Unicode, Batch, Source code)  Rich text files (rtf format)  files within the My Documents folder of your personal computer  files anywhere on your personal computer  removeable hard drives connected to your PC  Create custom folder lists for seaching (ability to include and exclude subfolders)  compressed files (zip, gzip, bzip, tar, rar, and z)  Microsoft Access database files (including 2007)  Any other known or unknown file type Source: http://www.identityfinder.com/Products/Identity_Finder_Feature_List.html

8. What else does Identity Finder scan?  Database connector  OLEDB (i.e., SQL, Oracle, Sybase, DB2, etc.)  Website crawler  HTTP or HTTPS  Remote file shares (SMB, NFS, Samba)  Email – Mailboxes, PST’s, MBOX, Tbird  IE & Firefox Cache  AnyFind vs. Specific Values (e-discovery requests)

9. What does Identity Finder do with the results?  Save as secured Identity Finder file (*.idf) using FIPS 140-2 validated 256 bit AES  Save as HTML Summary Report  Choose specific information for custom reports to be saved  Save as Full Export into Comma Separated Value format  Save as Executive Summary Report  Upload to Management Console  What about the hits?  Secure – encrypts the file using FIPS 140-2 validated 256 bit AES  Shred – based on DOD 5220.22-M standard  Ignore  Quarantine – Secures a copy of the file and shreds the original  Recycle – same as the windows recycle bin. Not a secure method.  Will clean web browser cache & registry

10. Architecture Overview  Client  Configuration User Interface INI Files MSI Customization Boot from CD  Management Console  IIS & SQL

11. Architecture – Client UI  Main  What to Search for  Where to Search  Tools and Options  Settings  Scheduling

12. Architecture – INI Files  Creating an INI File  Created in UI  Copied over  Run on demand or scheduled task  /jobmode /inifile=“.ini”

13. Architecture – Custom MSI  Creating the environment  Download Windows SDK (~1.1GB for Vista)  Install Orca.msi  Add system variables  Extract MSI  Run lictomsi.cmd  Import Tables  Schtasks for all systems  Include Management Console phone home  No x64 bit support…. Yet.

14. Identity Finder Client Lab

15. Architecture – Management Console  Single server, dual purpose  WS2003/2008 (x86 or x64)  IIS6 or IIS7 w/Metabase compatibility .Net Framework 3.5 SP1  Microsoft Report Viewer Redistributable 2008  Creates Client Registry Settings (x86 & x64)  SQL 2005/2008 (Express, Std, Ent)  Certificates & Encryption

16. IET DCCS Implementation  Powershell installation script  Started with custom MSI  x86 was fairly smooth Users couldn’t modify settings to rescan  x64 required some extra work No support for x64 so had to use INI files anyway  Moved to INI files  No reason to support two methods  Users can tweak settings and rescan systems  Scans launched using the system account

17. IET DCCS Architecture  Mangement Console  Separate virtual systems for IIS & SQL  Certificates  Clients  Leveraged Powershell to script installation Verify connectivity to MC Check system type Include password check Check for and uninstall previous versions Import registry key for MC Create INI Delete old scheduled task Schedule new scan

18. Lessons Learned  MC is a resource hog.  Nuances with schtasks.  Clients were configured to search for SSN & CC but also pulled up Back Account information.  Be prepared for False-Positives.  Password check really slows down the scan.  When configured as background service, it will allocate the remaining resources.

19. Breaking News  Features in the next version of Identity Finder.

20. Questions?

21. Identity Finder Management Console Lab