Re: Information Security Plan

[Valdis Kletnieks <valdis.kletnieks () VT EDU>]

On Thu, 14 Dec 2017 15:05:37 +0000, Adam Maynard said:

> A lot of Higher Ed uses Spirion (formerly Identity Finder).

I think he wanted a source code scanner, to identify where code was handling
PII so it could be audited more closely.  Unfortunately, that's going to be
tough - alerting on every occurrence of string(9) or string(11) (SSN  with/
without -) will probably false positive too much, while missing places where it's
handled as just string().  And you can't make a white/black
list until you already know the answer....

So you *could* search for places where it validates that it's 3 digits 2 digits 4 digits,
except that misses places where somebody forgot to do validation.. :)

For what it's worth, the Linux kernel developers use a tool called Coccinelle to do
semantic searches through C code (though it may be able to handle other languages too).

Attachment: _bin
Description: