Sensitive Information Identification and Remediation

NC State’s Sensitive Information Identification Remediation (SIIR) program is a campus security initiative to identify and resolve instances of sensitive university data inappropriately stored on campus or in cloud-based systems. The Office of Information Technology, in collaboration with university data stewards and other stakeholders, uses a combination of automated tools and other techniques to locate sensitive data such as:

  • Social Security numbers
  • Credit card data covered under the Payment Card Industry Data Security Standard (PCI-DSS)
  • Bank account information
  • Health information protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
  • Sensitive research data
  • Other sensitive data (see Tables of Data Elements at Determining Sensitivity Levels for Shared Data).

SIIR program benefits

  • Reduced instances of costly data breaches or exposure
  • Increased compliance with university policies and state, federal, and contractual requirements
  • Timely identification and correction of accidental insecure storage of sensitive data

Tools

Spirion

  • Formerly named Identity Finder, Spirion is the primary tool chosen by NC State for use with SIIR.
  • Spirion is being used to scan and remediate sensitive information on university-owned machines and data stores.
  • The two names are used interchangeably on the company website and at NC State.

Scanning focus

  • PCI data (primary focus)
  • Credit Card Numbers
  • Social Security Numbers.

Scanning schedule

  • OIT Security and Compliance plans to run weekly scans at random intervals Tuesday through Thursday.
  • There should be little impact to system performance while the scan is running in the background.
  • OIT will manage the results centrally and will contact the user or local IT support staff if sensitive data are identified.
  • Notifications via SysNews will announce the schedule when finalized.

Scanning time

  • The length of time to complete a scan depends on the amount of data being searched and the performance of the scanned computer.
  • The initial scan may take some time, depending on hard drive size and computer power.
  • Subsequent scans are generally faster and do not affect system performance.

Computer performance during scanning

If you experience significant sluggishness, please contact the NC State Help Desk at 919.515.4357 (HELP) or help@ncsu.edu.

Spirion Deployment

The Office of Information Technology (OIT) is requires that Spirion data security software be deployed by Monday, Nov. 27, 2017 on all university-owned devices that run Windows or macOS and are managed by WolfTech Active Directory/SCCM or Jamf Pro. This includes servers, desktops and laptops

For managed workstations

  • Managed workstations will receive the Spirion software via their deployment service, with established policies and schedules.
  • No action is required by the user to run the application.
  • If sensitive data is discovered, a member of the OIT Security and Compliance staff will notify and assist the user with data remediation.

For non-managed desktops and laptops

To download Spirion (Identity Finder) for non-managed Windows and Macintosh desktops and laptops, visit Software Licensing.

Exception Requests

In the event a university owned system requires an exemption from the installation, the department must complete an IT Exception Request with proper justification for the exemption for review.  Once S&C reviews and approves the request, the system will be placed in the appropriate exception group.

Availability

  • Spirion is available in Jamf Pro, SCCM and from Software Licensing.
  • NOTE: This is a new package. Please replace the current deployment with this new version.

Additional information

Visit the Spirion website: Links to User Guides, Documentation, and Feedback

Help

Please report any issues or questions to the NC State Help Desk at 919.515.4357 (HELP) or help@ncsu.edu.