Identity Finder: Time for a Fresh Start

Posted: October 15, 2015

Almost anyone with a chest freezer will admit that there are items lost at the bottom from several years ago that should be found and thrown out before they cause problems. The same is true with the dead batteries at the back of the kitchen junk drawer. And, not surprisingly since this is an IT newsletter, there is a good chance that Personally Identifiable Information (PII) is lost and forgotten inside your computer files and it is time to go digging to find it and throw it out before it causes us problems.

It has been five years since Penn State adopted Identity Finder software to scan our computers for Personally Identifiable Information (PII).  In that time we’ve seen multiple upgrades and enhancements to the software…upgrades that have been a mixed blessing.  Identity Finder today is faster than it has ever been…but this isn’t always noticeable since it is now able to search many more file types than it could search five years ago – pdf and jpg files for example.  Searching these files and finding PII that we can eliminate makes us all more secure, but also eats up the time savings that we gained with efficiency.

When Identity Finder scans it presents a list of data suspected to be PII.  You then remediate the findings either by shredding true PII or by choosing to ignore false positives.  Once ignored, those suspected PII findings are not found and presented again.  After computers have been compromised and a review of data-at-risk has been completed, IT security staff at the university and at college levels are finding that many computers contain PII in files that have been previously marked to be ignored.

To take advantage of the improved scanning capabilities of the newest version of Identity Finder, and to reduce risks and potential costs of secure data compromise, AgIT will be working with departments and counties to initiate a fresh scan of all computers later this fall/winter.  Previously ignored data will be found again, and it will be very important to evaluate the results and eliminate true PII.

More information will be coming in the next few months on the process and the schedule and the best practices for dealing with the information presented.