outgoing communication across a variety of channels, such as e-mail and IM, to identify sensitive information. They’re based on some of the same technologies—like pattern matching and contextual text search—that help antivirus and antispam tools block incoming threats.
Tools typically come with basic patterns already defined for personally identifiable information, such as Social Security and credit card numbers, as well as templates for commonly private information, such as legal filings, personnel data, and product testing results.
Companies typically look for three types of information using these tools, notes Paul Kocher, president of the Cryptography
Research consultancy. The first, and easiest, type is personally identifiable information, such as Social Security numbers and credit card information. The second type is confidential company information, such as product specifications, payroll information, legal files, or supplier contracts.
Although this information is harder to identify, most tools can uncover patterns of language and presentation when given enough samples, Kocher notes. The third category is inappropriate use of company resources, such as potentially offensive communications involving race.
The traditional security methods may restrict sensitive data to legitimate users, but Flynn and Ignatiev found that even legitimate users were putting the data, and their companies, at risk. At BCD Travel, a corporate travel service, nearly 80 percent of its 10,000 employees work in call centers and thus have legitimate access to sensitive customer information.
BCD and the Texans did not find malicious activity; instead, they found people who were unaware of security risks, such as sending a customer’s credit card number by e-mail to book a flight or room from a vendor that didn’t have an online reservations system.
Fidelity