Access Keys:
Skip to content (Access Key - 0)

Q: Tips for using Spirion at MIT

Answer

Here are general guidelines for running Spirion (depending on how you acquire the tool, some of these settings may already be configured). More detailed instructions can be found in the user guides provided by MIT:

The full user guides by Spirion can also be found online:

Types of files to search

Spirion looks for Social Security Numbers (SSN), Bank account and Credit Card numbers (CCN), Drivers Licenses, and Passwords. The more items that are selected, the slower the search - both SSN and CCN have well defined constructs, so will have fewer false positives. Searching for bank accounts, for example, may result in any MIT G/L account number being identified.

Locations to search

The software provided by IS&T searches the user's home folder, which should include Files, Email, Browser, and Compressed files. The locations option is grayed out by default. Users can include or exclude folders by adding them to their folders preference setting. Because the tool is tied to a profile, it will not search beyond the signed-in user's own home folder.

Reviewing results

On a Mac, when you click on a search result to preview it, if the file is big it will take a long time to appear in the preview window. Spirion uses the "spinning beach ball" to show activity taking place.

Staff who run Spirion regularly and who find sensitive data on their machine should follow these guidelines:

  • Identify what sensitive data exists and determine if there is a good reason for it to be there
  • Delete it if it is unnecessary
  • Confirm with your supervisor what sensitive data should remain on your machine
  • Make sure your machine is encrypted in case of theft!

Stopping or pausing a search

As Spirion is searching, it will show what it has found - there are icons for CCN, SSN, and bank accounts. Users can look at what has been found and take actions - e.g. shred, ignore - while the search continues. For very long runs, Windows users can 'pause/stop' and restart later. Spirion (formerly Identity Finder) flags files it has searched so it knows where to restart (For this reason, Spirion (formerly Identity Finder) should not be run, unless done in write-protect mode, if a compromise is suspected, since file attributes are changed, thus impacting forensics.) For Mac users, it is recommended not to interrupt Spirion (formerly Identity Finder); users have experienced freezing, resulting in the need to do a forced quit.

See Also

If you haven't found the answer to your question on this page, try the Spirion FAQ.

IS&T Contributions

Documentation and information provided by IS&T staff members


Last Modified:

August 03, 2020

Get Help

Request help
from the Help Desk
Report a security incident
to the Security Team
Labels:
identityfinder identityfinder Delete
c-idf c-idf Delete
c-spirion c-spirion Delete
spirion spirion Delete
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.
Feedback
This product/service is:
Easy to use
Average
Difficult to use

This article is:
Helpful
Inaccurate
Obsolete
Adaptavist Theme Builder (4.2.3) Powered by Atlassian Confluence 3.5.13, the Enterprise Wiki