Method and system for managing information associated with sensitive information in an enterprise
The present invention provides a method and system for providing a view of sensitive information across an enterprise. The method includes finding locations of data stores across the enterprise and thereafter searching for sensitive information within the data stores, based on policies. Upon identifying the sensitive information, the sensitive information is optionally quarantined, masked, or encrypted, again based on policies. Information about the locations of the data stores, the sensitive information associated with the data stores, and the masking steps taken, is saved in a repository, and can be tagged. A user may then query the repository to retrieve one or more views of the sensitive information, gaining an overview of the compliance posture of the enterprise relative to one or more data compliance regulations, and for potential data exposure risk areas be able to drill down for actionable level of details.
1. A system for displaying an aggregate view of data security across an enterprise, the system comprising:
a plurality of data stores, wherein each of the plurality of the data stores is configured to store information associated with the enterprise;
a secure reporting database configured to store locations of the plurality of the data stores within the enterprise, an address of each identified sensitive datum within each of the plurality of the data stores, and security attributes of the each identified sensitive datum with respect to the stored locations and the stored address of the each identified sensitive datum; and
a dashboard configured to display the aggregate view of the data security across the enterprise to a user in response to a query of the stored locations, the stored address, and the stored security attributes in the secure reporting database.
2. The system of claim 1 , wherein the aggregate view displays a percentage of secured data across the enterprise in relation to a percentage of sensitive data across the enterprise.
3. The system of claim 1 , wherein the aggregate view maps the types of security measures applied to the each identified sensitive datum across the enterprise.
4. The system of claim 1 , wherein the aggregate view maps the each identified sensitive datum by the location of the each corresponding data store, by a department of the enterprise, by a division of the department of the enterprise, or with respect to a product of the enterprise.
5. The system of claim 1 , wherein the aggregate view maps the each identified sensitive datum accessible to the user based on access rights or a privilege of the user.
6. The system of claim 1 , wherein the aggregate view displays the location of the each identified sensitive datum corresponding to a particular security policy of the enterprise.
7. A method for displaying an aggregate view of data security across an enterprise, comprising:
determining locations of data stores within the enterprise;
storing the locations of the data stores in a secure reporting database;
identifying each sensitive datum within each of the data stores;
storing an address of the each sensitive datum with respect to the each corresponding data store, each address stored in the secure reporting database;
for the each sensitive datum, recording security attributes of the each sensitive datum in the secure reporting database with respect to the stored locations and the stored address of the each sensitive datum;
generating a query related to a security of sensitive data of the enterprise;
querying the secure reporting database, comprising applying the query to the security attributes of the each sensitive datum stored in the secure reporting database;
receiving locations and addresses returned by the query;
aggregating the locations and the addresses returned by the query into a the aggregate view of the data security across the enterprise, the aggregate view responding to the query; and
displaying the aggregate view of the data security across the enterprise to a user in response to the query.
8. The method of claim 7 , further comprising periodically re-identifying the each sensitive datum in the each data store and refreshing the locations, the addresses, and the security attributes in the secure reporting database.
9. The method of claim 7 , wherein the aggregate view displays a percentage of sensitive data across the enterprise.
10. The method of claim 7 , wherein the aggregate view displays a percentage of secured data across the enterprise in relation to a percentage of sensitive data across the enterprise.
11. The method of claim 7 , wherein the aggregate view maps the types of security measures applied to the each sensitive datum across the enterprise.
12. The method of claim 11 , wherein the aggregate view maps a location of the each sensitive datum protected by a particular type of security measure across the enterprise.
13. The method of claim 7 , wherein the aggregate view maps the each sensitive datum by a location of the each corresponding data store, by a department of the enterprise, by a division of the department, or with respect to a product of the enterprise.
14. The method of claim 7 , wherein the aggregate view maps the each sensitive datum accessible to the user based on access rights or a privilege of the user.
15. The method of claim 7 , wherein the aggregate view displays a location or a percentage of unprotected sensitive data across the enterprise.
16. The method of claim 7 , wherein the aggregate view displays a degree of relative sensitivity of the each sensitive datum across the enterprise.
17. The method of claim 7 , wherein the aggregate view displays a location of the each sensitive datum corresponding to a particular security policy of the enterprise.
18. The method of claim 7 , wherein the query includes a security compliance criterion.
19. The method of claim 7 , further comprising masking an identified sensitive datum.
20. The method of claim 7 , wherein identifying the each sensitive datum includes applying a heuristic selected from the group consisting of a policy established at a corporate level, an expression pattern within a document, a Payment Card Industry Data Security Standard (PCI DSS), a Personally Identifiable Information (PII) standard, a Health Insurance Portability and Accountability Act (HIPAA) privacy rule, and a Social Security Number (SSN) pattern.