Systems and methods for identifying and mapping sensitive data on an enterprise
Embodiments of the present invention provide techniques, systems, and methods for remote, agent-less enterprise computer threat data collection, malicious threat analysis, and identification and reporting of potential and real threats present on an enterprise computer system. Specifically, embodiments are directed to a system that securely identifies and maps sensitive information from computers across the enterprise. Secure and sensitive information may be internally encrypted and analyzed for indicators of compromise, threatening behavior, and known vulnerabilities. The remote, agent-less collection, analysis, and identification process can be repeated periodically to detect and map additional sensitive information over time, and may delete itself after completion to avoid detection.
1. A computer-implemented method for sensitive data analysis, the method comprising:
receiving sensitive data parameters associated with an enterprise;
configuring a tool based on the sensitive data parameters;
distributing the tool to a plurality of computing systems in the enterprise, wherein at each computing system the tool is executed for:
scanning, in a stealth mode in a background of the computing system, the computing system to identify a plurality of files associated with the computing system,
analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters,
assigning an identifier to each of the sensitive files,
transferring each of the sensitive files to a data store that stores each of the sensitive files along with the corresponding identifier,
deleting each of the identified sensitive files from the computing system,
generating a sensitive data report including file information associated with each of the identified sensitive files,
sending the sensitive data report to the data store; and
deleting the tool from the computing system after the sensitive data report is sent to the data store;
obtaining a plurality of sensitive data reports associated with the plurality of computing systems from the data store, each sensitive data report associated with one of the plurality of computing systems;
generating a sensitive data map for the enterprise, the sensitive data map identifying each of the plurality of computing systems in the enterprise and the file information associated with each of the plurality of computing systems; and
causing an alert including the sensitive data map to be provided to an enterprise management system.
2. The method of claim 1 , wherein the sensitive data parameters include a plurality of sensitive data patterns, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of sensitive data patterns; and
identifying at least one matching expression based on at least one of the sensitive data patterns.
3. The method of claim 1 , wherein the sensitive data parameters include a plurality of sensitive keywords, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of keywords; and
identifying at least one matching expression based on at least one of the plurality of keywords.
4. The method of claim 1 , wherein the sensitive data report includes a file identifier, a file location, a file type, a computing system identifier, a file size, a type of sensitive data indicator, and the at least one matching expression for each of the sensitive files.
5. The method of claim 1 , wherein the tool is replicated by an enterprise management system and distributed to the plurality of computing systems within the enterprise.
6. The method of claim 1 , wherein the stealth mode executes the application in the background to hide the execution of the tool.
7. The method of claim 1 , wherein the computing system deletes the tool from the computing system after being executed by the computing system by performing a secure delete operation that removes the tool and data generated by the tool during execution of the tool from the computing system.
8. The method of claim 1 , wherein the data store comprises a first data store and a second data store, the sensitive files are transmitted to the first data store and the sensitive data report is transmitted to the second data store, and the first data store and the second data store are different.
9. A computing device for sensitive data analysis, the computing device comprising:
a processor; and
a computer-readable medium comprising code, executable by the processor, to perform a method comprising:
receive sensitive data parameters associated with an enterprise;
configure a tool based on the sensitive data parameters;
distribute the tool to a plurality of computing systems in the enterprise, wherein at each computing system the tool is executed for:
scanning, in a stealth mode in a background of the computing system, the computing system to identify a plurality of files associated with the computing system,
analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters,
assigning an identifier to each of the sensitive files,
transferring each of the sensitive files to a data store that stores each of the sensitive files along with the corresponding identifier,
deleting each of the identified sensitive files from the computing system,
generating a sensitive data report including file information associated with each of the identified sensitive files,
sending the sensitive data report to the data store; and
deleting the tool from the computing system after the sensitive data report is sent to the data store;
obtain a plurality of sensitive data reports associated with the plurality of computing systems from the data store, each sensitive data report associated with one of the plurality of computing systems;
generate a sensitive data map for the enterprise, the sensitive data map identifying each of the plurality of computing systems in the enterprise and the file information associated with each of the plurality of computing systems; and
cause an alert including the sensitive data map to be provided to an enterprise management system.
10. The computing device of claim 9 , wherein the sensitive data parameters include a plurality of sensitive data patterns, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of sensitive data patterns; and
identifying at least one matching expression based on at least one of the sensitive data patterns.
11. The computing device of claim 9 , wherein the sensitive data parameters include a plurality of sensitive keywords, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of keywords; and
identifying at least one matching expression based on at least one of the plurality of keywords.
12. The computing device of claim 9 , wherein the sensitive data report includes a file identifier, a file location, a file type, a computing system identifier, a file size, a type of sensitive data indicator, and the at least one matching expression for each of the sensitive files.
13. The computing device of claim 9 , wherein the tool is replicated by an enterprise management system and distributed to the plurality of computing systems within the enterprise.
14. The computing device of claim 9 , wherein the stealth mode executes the application in the background to hide the execution of the tool.
15. The computing device of claim 9 , wherein the computing system deletes the tool from the computing system after being executed by the computing system by performing a secure delete operation that removes the tool and data generated by the tool during execution of the tool from the computing system.
16. The computing device of claim 9 , wherein the data store comprises a first data store and a second data store, the sensitive files are transmitted to the first data store and the sensitive data report is transmitted to the second data store, and the first data store and the second data store are different.
17. A non-transitory computer readable storage medium, which when executed by a processing system of a computing device, causes the computing device to perform operations for sensitive data analysis, the operations comprising:
receiving sensitive data parameters associated with an enterprise;
configuring a tool based on the sensitive data parameters;
distributing the tool to a plurality of computing systems in the enterprise, wherein at each computing system the tool is executed for:
scanning, in a stealth mode in a background of the computing system, the computing system to identify a plurality of files associated with the computing system;
analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters;
assigning an identifier to each of the sensitive files;
transferring each of the sensitive files to a data store that stores each of the sensitive files along with the corresponding identifier;
deleting each of the identified sensitive files from the computing system;
generating a sensitive data report including file information associated with each of the identified sensitive files;
sending the sensitive data report to the data store; and
deleting the tool from the computing system after the sensitive data report is sent to the data store;
obtaining a plurality of sensitive data reports associated with the plurality of computing systems from the data store, each sensitive data report associated with one of the plurality of computing systems;
generating a sensitive data map for the enterprise, the sensitive data map identifying each of the plurality of computing systems in the enterprise and the file information associated with each of the plurality of computing systems; and
causing an alert including the sensitive data map to be provided to an enterprise management system.
18. The non-transitory computer readable storage medium of claim 17 , wherein the sensitive data parameters include a plurality of sensitive data patterns, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises operations for:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of sensitive data patterns; and
identifying at least one matching expression based on at least one of the sensitive data patterns.
19. The non-transitory computer readable storage medium of claim 17 , wherein the sensitive data parameters include a plurality of sensitive keywords, and wherein analyzing each of the plurality of files to identify sensitive files including sensitive data matching at least one of the sensitive data parameters further comprises operations for:
parsing each of the plurality of files to identify a plurality of expressions within each of the plurality of files;
comparing each of the plurality of expressions to each of the plurality of keywords; and
identifying at least one matching expression based on at least one of the plurality of keywords.
20. The non-transitory computer readable storage medium of claim 17 , wherein the sensitive data report includes a file identifier, a file location, a file type, a computing system identifier, a file size, a type of sensitive data indicator, and the at least one matching expression for each of the sensitive files.