Information security implementations with extended capabilities
Systems, devices or methods provide for control of sensitive data in a computer system that includes at least one central server communicatively-coupled to a plurality of client computers. A particular method relates to the execution of software code on the at least one central server to monitor data communications of the plurality of client computers for sensitive data. A subset of the data communications is restricted when sensitive data is detected. Configuration data is provided to each of the plurality of client computers. Software code is executed on each of the plurality of client computers to detect accesses to sensitive data by one or more applications running on a client computer. Actions of the one or more applications running on a client computer are monitored to determine whether or not a trigger event has occurred. In response to determining that the trigger event has occurred, a notification is sent.
1. A security system comprising:
at least one central server coupled to a plurality of client computers and configured to:
in response to a notification received from one of the plurality of client computers, monitor data communications of the one of the plurality of client computers for sensitive data by reviewing data communications therefrom;
receive identified data from applications running on the plurality of client computers and which data indicates an access of sensitive data matching criteria indicated by configuration data used to indicate a sensitivity level of the sensitive data and monitored data communications;
in response to the identified data indicating that a first trigger event occurred, determine that a second trigger event occurred which is related to the identified data, wherein the first trigger event includes at least access of an external email address associated with said one of the plurality of client computers, and the second trigger event includes a cut and paste operation also associated with said of the plurality of client computers; and
select and perform a security action based on the occurrence of the first and second trigger events, and based on a risk-level associated with the first and second trigger events.
2. The system of claim 1 , wherein the central server is configured to apply a learning algorithm that defines parameters for detecting sensitive data.
3. The system of claim 1 , wherein the central server is configured to receive the configuration data as part of a viral definitions file that identifies both sensitive data and potential viruses.
4. The system of claim 1 , wherein the central server is configured to scan content of directories designated as secure and to identify sensitive data according to results of the scan, and wherein the sensitive data is encrypted according to different levels of protection as a function of trigger events, a type of portable medium to which the sensitive data is saved, and the sensitivity level of the data.
5. The system of claim 1 , wherein:
the identified data includes a first data file associated with a low risk-level and a second data file associated with a high risk-level; and
the central server is configured and arranged to generate a report documenting high-risk events for further review via at least one of the plurality of client computers.
6. The system of claim 5 , wherein the first and second trigger events each include one or more of sending data to email groups, uploading files to remote locations, editing sensitive data, attempts to access restricted data storage locations, inclusion of internal links within external communications, cut-and-paste with sensitive data in an active window and print screen;
wherein the association between the first trigger event and the second trigger event is provided from one of a plurality of event relationships that define how the system responds with the security action; and
wherein the at least one central server is configured to adjust the trigger events and responses thereto based on input received from the one or more of the plurality of client computers.
7. The system of claim 5 , wherein:
the plurality of client computers are configured to detect accesses to sensitive data by applications running on the plurality of client computers; and
the central server is configured and arranged to receive from at least one of the plurality of client computers, input customizing content of reports to be provided to the plurality of client computers.
8. The system of claim 1 , wherein the system is configured to categorize the sensitivity level of data according to a creator and a user of the data.
9. The system of claim 8 , wherein the sensitivity level of the data is in response to a level of secure access afforded to the creator and the user of the data.
10. The system of claim 8 , wherein the plurality of client computers are configured to tag transmitted data, in response to the transmitted data including sensitive data, and wherein the at least one central server is configured to select from a plurality of scan levels in response to the tagged data.
11. The system of claim 1 , further including a security database configured as a reference for storing and identifying sensitive data, wherein the security database includes keywords, locations, document types, specific content and heuristic signatures arranged for access by the system to assess and determine a risk level.
12. The system of claim 1 , when the at least one central server is further configured to verify correct operation of security software on at least one client computer of the plurality of client computers by:
performing actions to trigger a test trigger event at the at least one client computer; and
determining whether the at least one client computer transmits a notification indicating the test trigger event has occurred.