Sensitive data detection

1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:

receiving a plurality of data segments, wherein

each data segment matches a syntax for a predetermined data type, and

a validation scheme for the predetermined data type defines a first portion and a second portion of a valid data segment, wherein the second portion includes a check value calculated by applying a predetermined algorithm to the first portion;

detecting a data leakage in the plurality of data segments by:

incrementing a risk count for each one of the data segments that passes a validation using the predetermined algorithm and the check value,

decrementing the risk count for each one of the data segments that fails the validation using the predetermined algorithm and the check value, and

detecting the data leakage in response to the risk count meeting a first predetermined threshold;

detecting no data leakage in the plurality of data segments in response to the risk count meeting a second predetermined threshold; and

in response to detecting the data leakage, remediating a leakage of sensitive data associated with the risk count meeting the first predetermined threshold.

2. The computer program product of claim 1 , wherein the first predetermined threshold is a quantitative threshold indicating that a majority of the data segments are of the predetermined data type.

3. The computer program product of claim 1 , wherein the predetermined data type includes at least one of a social security number, a credit card number, a telephone number, a bank account number, and a driver's license number.

4. The computer program product of claim 1 , further comprising code that, when executing on the one or more computing devices, causes the one or more computing devices to perform the step of, maintaining a plurality of risk counts for the plurality of data segments, each one of the plurality of risk counts associated with a different syntax of a different data type having a different check value calculated with a different predetermined algorithm.

5. A method comprising:

receiving a plurality of data segments, wherein:

each data segment matching a syntax for a predetermined data type, and

a validation scheme for the predetermined data type defining a first portion and a second portion of a valid data segment, the second portion including a check value calculated by applying a predetermined algorithm to the first portion;

identifying a first quantity of the plurality of data segments as valid for the predetermined data type based on a presence of corresponding check values calculated with the predetermined algorithm;

identifying a second quantity of the plurality of data segments as invalid for the predetermined data type based on an absence of corresponding check values calculated with the predetermined algorithm;

detecting a potential data leakage based on the first quantity and the second quantity; and

in response to detecting the potential data leakage, remediating a leakage of sensitive data associated with the predetermined data type.

6. A method comprising:

storing a validation scheme for a predetermined data type of sensitive data, the validation scheme including:

a syntax associated with the predetermined data type, and

a validation algorithm for the predetermined data type;

receiving a data stream;

identifying a data segment in the data stream having the syntax of the predetermined data type;

performing an evaluation of whether the data segment belongs to the predetermined data type based on the validation algorithm; and

incrementally updating a data classification score for the data stream based on the evaluation of the data segment in the data stream.

7. The method of claim 6 , further comprising, in response to the data classification score meeting a predetermined threshold, initiating a remedial measure to address a leakage of data of the predetermined data type.

8. The method of claim 6 , wherein the data stream includes a network data flow from an endpoint in an enterprise network.

9. The method of claim 6 , wherein the data stream includes a stream of data retrieved from a data store.

10. The method of claim 6 , wherein the evaluation includes calculating a check value for the data segment based on the validation algorithm and checking for a presence of the check value in the data segment.

11. The method of claim 6 , wherein incrementally updating the data classification score includes increasing the data classification score when the evaluation indicates that the data segment belongs to the predetermined data type.

12. The method of claim 6 , wherein incrementally updating the data classification score includes decreasing the data classification score when the evaluation indicates that the data segment does not belong to the predetermined data type.

13. The method of claim 6 , wherein incrementally updating the data classification score includes:

updating the data classification score incrementally for each of a plurality of additional data segments in the data stream based on whether each of the plurality of additional data segments is determined to be of the predetermined data type; and

in response to the data classification score meeting a predetermined threshold, remediating the data stream as a leakage of sensitive data.

14. The method of claim 6 , further comprising initiating a remedial action for data leakage when the data classification score meets a predetermined threshold.

15. The method of claim 6 , wherein the predetermined data type includes at least one of a social security number, a credit card number, a telephone number, a bank account number, and a driver's license number.

16. A system comprising:

a data set stored in a data store;

a validation scheme stored at a threat management facility, the validation scheme including a syntax and a validation algorithm for a predetermined data type; and

a sensitive data detection system configured by computer executable code stored at the threat management facility to perform the steps of:

receiving the data set from the data store;

identifying a data segment in the data set having the syntax of the predetermined data type;

performing an evaluation of whether the data segment belongs to the predetermined data type based on the validation algorithm; and

incrementally updating a data sensitivity score for the data set based on the evaluation of the data segment in the data set.

17. The system of claim 16 , wherein the predetermined data type includes at least one of a social security number, a credit card number, a telephone number, a bank account number, and a driver's license number.

18. The system of claim 16 , wherein the threat management facility stores a plurality of validation schemes for a plurality of sensitive data types, and wherein the sensitive data detection system is configured to check for each of the plurality of sensitive data types in the data store.

19. The system of claim 16 , wherein the predetermined data type includes a date.

20. The system of claim 16 , wherein the threat management facility is configured to remediate, based on the data sensitivity score, one or more endpoints in an enterprise network managed by the threat management facility.