System for assuring security of sensitive data on a host

1. A system comprising:

one or more memories storing computer-executable instructions; and

one or more hardware processors configured to execute the computer-executable instructions to:

access a plurality of messages;

designate for further analysis a particular message of the plurality of messages;

determine that the particular message includes a first data classification tag indicative of sensitive data and that refers to a first value comprising sensitive data by parsing the particular message to identify strings indicative of the first data classification tag and the first value;

access log data;

determine the parsed first value is present in the log data; and

based on the first value being present in the log data, perform one or more actions to prevent inclusion of the sensitive data into the first log data.

2. The system of claim 1 , further comprising computer-executable instructions to:

determine that the particular message includes a second data classification tag indicative of public data and a second value comprising public data by parsing the particular message to identify strings indicative of the second data classification tag and the second value;

determine the second value is not present in the log data; and

responsive to the determination that the second value is not present in the log data, generate an alarm indicative of a logging malfunction.

3. The system of claim 1 , further comprising computer-executable instructions to:

determine a count of occurrences of the first value in the log data exceeds a threshold value; and

responsive to the determination the count of occurrences of the first value in the log data exceeds the threshold value, increase a level of security associated with the service by:

reducing a maximum number of read operations to memory permitted to the service,

reducing a maximum number of write operations to memory permitted to the service,

limiting communication by the service to a set of predefined services,

restricting access to one or more of an input device or an output device,

encrypting the log data,

changing collection of the log data from a verbose logging that includes the sensitive data to a terse logging that only includes a session identifier and a timestamp, or

disabling collection of the log data.

4. The system of claim 1 , further comprising computer-executable instructions to:

determine the sensitive data is included in the log data; and

based on the determination that the sensitive data is included in the log data, prevent writing of the additional sensitive data to the log data.

5. The system of claim 1 , further comprising computer-executable instructions to:

determine that a predetermined amount of time has passed since the addition of the value to the watch data; and

based on this determination that a predetermined amount of time has passed since the addition of the value of the watch data, remove the value from the watch data.

6. A method comprising:

determining a message sent to a first service executing on a first device, wherein the message includes a first value and a first data classification tag indicative of sensitive data and that refers to the first value;

adding the first value to first watch data based on presence of the first data classification tag in the message;

accessing log data;

generating search results that are indicative of the first value in the log data by searching the log data for one or more values indicative of the first value in the first watch data;

determining the search results indicate that the one or more values in the first watch data are in the log data; and

based on the determination that the one or more values in the first watch data are in the log data, performing one or more actions to prevent inclusion of the sensitive data into the first log data.

7. The method of claim 6 , further comprising:

identifying a number of occurrences of the first value in the log data;

determining a threshold value for the number of occurrences of the first value in the log data;

determining that the number of occurrences of the first value in the log data exceeds the threshold value; and

based on the determination that the number of occurrences of the first value in the log data exceeds the threshold value, performing the one or more actions to prevent leakage of the sensitive data into the log data.

8. The method of claim 6 , the one or more actions comprising disabling collection of the log data.

9. The method of claim 6 , the one or more actions includes one or more of generating an alarm, deactivating the first service, or increasing security controls associated with execution of the first service to restrict storing of the sensitive data to a secure environment.

10. The method of claim 6 further comprising:

accessing monitor data indicative of the message sent to the first service, the monitor data including the first value, the first data classification tag indicative of sensitive data and that refers to the first value, and information indicative of context data for the message.

11. The method of claim 6 , wherein the context data is indicative of one or more of an application session identifier, source network address, a communication session identifier, a timestamp, or a process identifier.

12. The method of claim 6 , further comprising:

determining a first timestamp associated with the message;

determining a second timestamp associated with an entry in the log data that has a second value matching the first value;

determining a difference between the first timestamp and the second timestamp is less than the threshold value; and

responsive to the determination that the difference between the first timestamp and the second timestamp is less than the threshold value, performing the one or more actions.

13. The method of claim 12 , further comprising:

determining a predetermined amount of time has passed between the first timestamp and the second timestamp;

based on the determination that the predetermined amount of time has passed between the first timestamp and the second timestamp, removing the first value from the first watch data.

14. The method of claim 6 further comprising:

determining a size of the watch data;

comparing the size of the watch data to a threshold value to determine whether the size of the watch data exceeds the threshold value; and

based on the determination that the size of the watch data exceeds the threshold value, performing the one or more actions.

15. The method of claim 6 , wherein the one or more actions include one or more of:

terminating an existing data connection with a second service that sent the message,

preventing the opening of additional data connections with the second service,

removing one or more execution privileges from the first service executing on the first device,

limiting communication by the first service module to a set of predefined services, or

terminating execution of the first service.

16. The method of claim 6 further comprising:

accessing monitor data indicative of the message, the monitor data including information indicative of context data for the message;

from the context data, obtaining a network source address, a timestamp, and a process identifier associated with the message; and

identifying the message based on the network source address, the timestamp, and the process identifier associated with the message.

17. The method of claim 6 , further comprising:

accessing monitor data indicative of the message;

determine context data from the monitor data; and

from the context data, determine that the context data includes one or more of:

an application session identifier;

a source network address;

a communication session identifier; or

a process identifier;

disregarding messages associated with particular values of the one or more of the application session identifier, the source network address, the communication session identifier, or the process identifier.

18. A system comprising:

a first host comprising:

a first memory storing first computer-executable instructions; and

a first hardware processor configured to execute the first computer-executable instructions to:

determine a first data classification tag indicative of sensitive data and that refers to a first value in a message sent to a first service;

store the first value;

search first log data for one or more values indicative of the first value to generate search results; and

responsive to the search results indicating that the one or more values are in the first log data, perform one or more actions to prevent inclusion of the sensitive data into the first log data.

19. The system of claim 18 , further comprising:

a second host comprising:

a second memory storing second computer-executable instructions; and

a second hardware processor configured to execute the second computer-executable instructions to:

generate the message to the first service;

send the message to the first service on the first host;

send, to the first host, monitor data including context data associated with the message, the context data indicative of one or more of an application session identifier, source network address, a communication session identifier, a timestamp, or a process identifier; and

the first hardware processor configured to execute the first computer-executable instructions to:

access the monitor data including the context data associated with the message; from the context data, obtaining a source network address, the timestamp, and the process identifier associated with the message; and

identify the message based on the network source address, the timestamp, and the process identifier associated with the message.

20. The system of claim 18 , the first hardware processor configured to execute the first computer-executable instructions to:

determine a first timestamp associated with the message;

determine a second timestamp associated with an entry in the log data that has a second value matching the first value;

determine a difference between the first timestamp and the second timestamp is less than a threshold value; and

responsive to the determination that the difference between the first timestamp and the second timestamp is less than the threshold value, perform the one or more actions.