User data governance

What does the ‘Shared with’ field indicate on User Data Governance tickets?

The Shared with field within User Data Governance tickets identifies the user(s) who can access the file. Public sharing indicates that the intrusive file is accessible to all users who possess the file link.

Can wildcard characters be used in the Specific Keywords section of the User Data Governance module within the Coro Console?

In addition to wildcard character support, the Specific Keywords section supports searches based on regular expression (regex).

What is flagged in a Suspicious Exposure of Certificate ticket?

Security certificates, including files with .crt or .pem extensions, are digital certificates that can be used to establish secure connections between a client and a server. These files are regarded as sensitive.

What is the difference between Can Access vs Can Access and Expose permissions?

Can Access and Expose: Users with these permissions can share sensitive data files and emails, as well as access files shared by other users. Tickets are not generated.

Can Access: Users with these permissions can access files containing sensitive data shared by other users without generating a ticket. However, such files cannot be shared, and sharing tickets are generated.

Why does Coro only detect a small number of sensitive data occurrences within a file when a file scan is run?

The purpose of file scans (on endpoint device drives and in general) is to identify files containing sensitive information so that admin users are notified of potential risks and can take appropriate measures to protect the sensitive information in question, by either:

• Adjusting data governance permissions

• Taking measures prescribed by their organization's data governance policy

It is not necessary to detect all occurrences of each type of sensitive information within a given file for that, so Coro limits the number of such detected occurrences to optimize performance and (in the case of endpoint devices) improve end-user experience.

What social security number (SSN) pattern does Coro detect?

Coro recognizes US social security numbers (SSNs). Coro additionally detects SSNs on a predefined list of keywords if the SSN is in an unrecognized format.

Under what circumstances does Coro automatically close User Data Governance tickets?

Tickets containing sensitive information, but that do not require manual review by admin users, are automatically closed.

Such tickets are included in the Coro console ticket log for audit, monitoring, analysis, and to satisfy regulatory compliance requirements. They are typically triggered automatically by events such as the detection of sensitive information in an email, file, or file sharing. Some examples of this type of ticket include:

• Personal Identifiable Information (PII): IP and MAC address.

• Nonpublic Personal Information (NPI): Monthly payment (financial content) and email address.

• Protected Health Information (PHI): Medical Records Number (MRN).

Why does Coro create multiple User Data Governance tickets related to the same event?

Coro can identify stored sensitive information on user devices that potentially violate one or more regulatory or data compliance standards. Such information falls into one of the following categories:

• Personally Identifiable Information (PII): Information connected to a specific individual that can be used to uncover that individual's identity, such as full name, email address, passport number, or social security number.

• Payment Card Industry (PCI): A set of security standards created by major credit card providers designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

• Protected Health Information (PHI): Data collected, stored, used, or transmitted during the provision of health care services. This data includes patient name, medical history, and health insurance information.

• Non-Public Personal Information (NPI): Personal financial data that is collected and stored by financial institutions. NPI is a combination of PII and other indicators. For example, social security numbers are PII indicators, but in combination with credit card information, they are also classified as NPI.

The following table lists sensitive information detectors that Coro is able to identify and their respective categories:

What is a false positive User Data Governance ticket?

These tickets are most likely not false positives, but rather Coro is generating data monitoring tickets according to your enabled monitoring options under User Data Governance.

To configure User Data Governance data monitoring in Coro:

1. Sign in to the Coro console.

2. From the sidebar, select to access the Control Panel.

3. Select User Data Governance:

   

4. From the Monitoring page, enable or disable the monitoring options:

   

Can I exclude certain indicators to limit the number of tickets generated by Coro?

Yes, to exclude User Data Governance monitoring options:

1. Sign in to the Coro console.

2. From the sidebar, select to access the Control Panel.

3. Select User Data Governance:

   

4. From the Monitoring page, disable the monitoring options:

   

Is there a document available that details how Coro helps companies follow the National Institute of Standards and Technology (NIST) framework?

See the Federal Information Security Modernization Act (FISMA) compliance document.

FISMA aims to reduce the potential risk of unauthorized data use, and to develop, document, and implement an information security and protection program disclosure. The governed federal agencies need to comply with the information security standards guidelines, and mandatory required standards developed by NIST.

To what types of sensitive data does 'Exclude emails with specified keyword in the subject line' apply?

'Exclude emails with specified keyword in the subject line' is applicable to all sensitive data types as follows:

• Suspicious exposure of certificate

• Suspicious exposure of critical data

• Suspicious exposure of file type

• Suspicious exposure of password

• Suspicious exposure of source code

Does Coro scan cloud drive data for sensitive data at rest?

No, Coro does not scan for sensitive data at rest.

What does the ‘Remove Permission’ action on the Permissions page do?

The Remove Permission action (User Data Governance > Permissions) removes an existing permission configured to restrict:

• Unauthorized data exposure of sensitive information.

• Unauthorized data access to sensitive information.

Protected users have access to sensitive information granted by default. You can use the Permissions page to add restrictions according to your organizational needs. Permissions can be set for:

• All Users

• Specific Groups of Users

• Specific Users/Domains

How can a new customer select a desired data storage region?

The customer selects their preferred data storage region when setting up with the Coro sales team. Customers cannot select the storage region independently. After a data storage region is selected for a parent workspace, it cannot be changed.

Can a customer select to store data in multiple locations, for example, one workspace in the U.S. and one in Canada?

Yes. Coro can store data in multiple locations provided each parent channel workspace resides in a separate region.

Can MSPs have child workspaces in different regions?

Workspace regions are determined at the parent level. MSPs require separate parent workspaces in order to have child workspaces in multiple regions.

How do I identify deployments located in different regions?

Each deployment has its own URL as follows:

• U.S: secure.coro.net

• EU: secure-eu.coro.net

• Canada: secure-ca.coro.net

How do I set up a workspace in a requested region?

To setup a workspace in a requested region, use the correct regional URL to access the console and follow the usual workspace creation process.

Where is the European Union (EU) data center located?

The EU data center is located in Germany, and enables German customers and other EU customers to comply with local and EU-wide regulations, respectively.

Does Coro exclusively create User Data Governance tickets from data that is in English, or does it also translate and create User Data Governance tickets from other languages?

User Data Governance tickets are only created from data in English.

Does User Data Governance work on scanned documents?

User Data Governance can process standalone image files but does not support scanned PDFs or images embedded in documents such as Microsoft Word files. The supported image formats are:

• jfif
• jpeg
• jpg
• png
• tiff
• webp
• x-portable-anymap
• x-portable-bitmap
• x-portable-graymap
• x-portable-pixmap

Does User Data Governance Data objects with specific keywords require exact matches?

Yes, User Data Governance Data objects with specific keywords operates on exact keyword matches.

Does User Data Governance Data objects with specific keywords detect keywords in the subject lines of emails?

Yes, User Data Governance Data objects with specific keywords detects keywords in the subject lines of emails.

Can User Data Governance scan SQL code?

User Data Governance can analyze SQL code found in shared files; however, it cannot scan SQL code embedded in the stored procedures of database systems.

What region-specific sensitive data does Coro detect?

Coro detects sensitive data types specific to multiple regions. This includes data such as national ID numbers, passport numbers, driver's licenses, tax identifiers, and healthcare data. Each data type is classified by regulatory category and regional format to support compliance with local privacy laws.

For more information, see Sensitive data recognized by Coro.

How does Coro reduce alert fatigue for User Data Governance sensitive data tickets?

Coro consolidates findings with monitored sensitive data types across the email subject, body, and attachments into a single ticket: Email Containing Sensitive Data. For more details, see Ticket types for User Data Governance. It groups related detections into one section and specifies the location and type of each finding, reducing alert fatigue and streamlining investigation.