Regulatory sensitive information

Sensitive data is data that is considered private or protected by law, policy, or contractual obligation. The Coro console discovers sensitive data stored on your users' devices that may be subject to regulatory or data compliance requirements.

note

Each organization is unique and is required to comply with specific sensitive data regulatory requirements. Use the Coro interactive discovery tool here to assess your specific data governance needs.

The following table shows the data transactions monitored by Coro. It includes information on the type of monitoring:

Transaction Monitoring Detection Component
Files on local and removable endpoint drives Access On Scan Devices
Important

Scanning endpoint drives for sensitive data is a resource (CPU/memory) consuming operation.

Sensitive data objects which can be exposed and monitored by Coro from the transactions above can be categorized into the following four types:

Personally identifiable information (PII)

PII is any information connected to a specific individual that can be used to uncover that individual's identity This data includes:

  • Social security numbers (SSNs)
  • Full Name
  • Email address

Payment card industry (PCI)

The major credit card providers enforce security standards established by the PCI. These standards ensure that companies maintain a secure environment for accepting, processing, storing, or transmitting credit card data. The Payment Card Industry Security Standards Council (PCI SSC) manages and administers these security standards to enhance payment account security. For more information regarding the PCI standards, visit the PCI SSC website here.

Protected health information (PHI)

PHI is data collected, stored, used, or transmitted during the provision of health care services. This data includes patient:

  • Name
  • Medical history
  • Health insurance information

Non-Public personal information (NPI)

NPI is personal financial data that is collected and stored by financial institutions. NPI is a combination of PII and other indicators. For example, SSNs are PII indicators, but in combination with credit card information, they are also classified as NPI.

  • A closed NPI ticket is generated when PII AND another indicator, for example, financial keywords (financial metadata, content, forms, or PCI.)
  • An open NPI ticket is generated if in addition to PII, PCI is also detected.
note

You can view tickets from the Endpoint Data Governance component on the Actionboard:

Endpoint Data Governance component

Findings

When a data on a device violates a sensitive data policy, a policy violation occurs and a ticket is generated. The ticket displays the following details:

  • Findings : The Findings list displays a list of files that violated a particular policy. The following information is displayed:
    • Findings : The filename and file extension of the file that caused a policy violation
    • # of findings : The number of policy violation detected in the file

      Findings

    The Findings list can be expanded to display additional information:

    • File path : The file path.
    • File size : The file size, in KB.
    • Type : The type of sensitive data, for example, Credit card number.
    • Quote : The text string in quotes containing the sensitive data, for example, "of PCI that can lead to identifying an individual . 6945 CVV 123 Test".

      Findings expanded