Kevin Beaver's Security Blog

Great tool for seeking out sensitive info on your network

One of the greatest risks in business today is the issue of unstructured information scattered about the network waiting to be misused and abused by rogue insiders and other outsiders that have gained “internal” access.

Reality has shown us that we absolutely cannot protect what we don’t acknowledge. The best way to minimize this risk is to search your network far and wide for PII and other sensitive business information you can’t afford to have exploited so you’ll know which controls you need to put in place to keep it safe. I’ve done this with basic text search tools such as the one built right into Windows Explorer. Some enterprise solutions to this have come (and gone) in the name of data classification, storage management, and e-discovery tools.

But there’s a tool I recently came across that’s piqued my interest called Identity Finder shown in the screenshot below:

Identity Finder has both a standalone and an enterprise version that will search inside many of the common file types and, as you can see in the figure above, seek out credit card numbers, passwords, SSNs, bank account numbers, and more. It’s amazing what it will dig up on any given system…reason enough to make you at least want to encrypt your laptop hard drives.

I haven’t been real pleased with the overall performance of the tool and the consulting license for the enterprise edition is well out of my price range given all the other costs associated with performing a reasonable internal vulnerability assessment. But overall Identity Finder is definitely worth checking out – especially if you’re trying to make the case for unstructured information and identity theft risks or you’re trying to take your information classification, compliance, and risk management initiatives to a new level.