Question

Search and destroy / capturing illegal data…

The Environment:
I manage a few very “open” databases. The type of access is usually full select/insert/update/delete. The mechanism for accessing the data is usually through linked tables (to SQL-Server) in custom-build MS Access databases.

The Rules
No social security numbers, etc. (e.g., think FERPA/HIPPA).

The Problem
Users enter / hide the illegal data in creative ways (e.g., ssn in the middle name field, etc.); administrative/disciplinary control is weak/ineffective. The general attitude (even from most of the bosses) is that security is a hassle, if you find a way around it then good for you, etc. I need a (better) way to find the data after it has been entered.

What I’ve Tried

Initially, I made modifications to the various custom-built user interfaces folks had (that I was aware of), all the way down to the table structures that they were linking to our our database server. The SSN’s, for example, no longer had a field of their own, etc. And yet…I continue to find them buried in other data fields.

After a secret audit some folks at my institution did, where they found this buried data, I wrote some sql that (literally) checks every character in every field field in every table of the database looking for anything that matched an ssn pattern. It takes a long time to run, and the users are finding ways around my pattern definitions.

My Question
Of course, a real solution would entail policy enforcement. That has to be addressed (way) above my head, however, it is beyond the scope and authority of my position.

Are you aware of or do you use any (free or commercial) tools that have been targeted at auditing for FERPA & HIPPA data? (or if not those policies specifically, then just data patterns in general?

I’d like to find something that I can run on a schedule, and that stayed updated with new pattern definitions.

Answer 1

I would monitor the users, in two ways.

1. The same users are likely to be entering the same data, so track who is getting around the roadbloacks, and identify them. Ensure that they are documented as fouling the system, so that they are disciplined appropriately. Their efforts create risk (monetary and legal, which becomes monetary) for the entire organization.
2. Look at the queries that users issue. If they are successful in searching for the information, then it is somehow stored in the repository.

If you are unable to track users, begin instituting passwords.

In the long-run, though, your organization needs to upgrade its users.