Sensitive Data Discovery using Spirion (formerly Identity Finder)

Overview

Spirion (formerly Identity Finder) is commercial software used to search for personal information, including Social Security numbers, credit card numbers, bank account details, and more. It can search in local and remote drives, emails, and synchronized storage such as Berkeley's bConnected Box.

Spirion’s primary use is for devices that routinely handle data classified at P3 or P4, as specified in the Data and IT Resource Classification Standard.

Receiving Licenses

Licenses are available for departments and users with clear business needs, including:

• Departments that routinely handle P3 or P4 data and must ensure it is restricted to designated systems.
• Units launching projects to verify that non-public data types are not present in their environment.
• Individuals or departments involved in security incident response requiring data exposure verification.

License Structure

There are two options for allocating licenses:

Single Device Licensing

• Licensed for a single, specific device (non-transferable).
• Licenses are reclaimed annually in July.
• Supports the OCR module for the individual machine’s local drives.
• Does not support scanning file shares, databases, or websites.

Departmental Licensing

• Licensed based on the total full-time FTE in the department (students and contractors are not counted).
• Allows for scanning of all devices within the department.
• Supports all modules, including file shares, OCR, databases, and websites.
• Limited to scanning the licensed department's data (e.g., specific group directories on a shared server).
• Licenses are reclaimed annually in July.

Disallowed Scanning

Campus-wide resources, such as CalShare or Research Hub, may not be scanned under the terms of this license. Spirion is currently not appropriate for cloud instances (AWS, GCP, Azure, etc.).

License Requests

To request licenses, email security-scanning@berkeley.edu. Please include:

• The preferred licensing type (Single Device or Departmental).
• The number of licenses (for single-use) or your total departmental FTE count.

Help and Documentation

For step-by-step instructions, please see the ISO guide: Using Identity Finder (PDF).

---

Privacy and Compliance

The University protects the privacy of Electronic Communication Records. You must ensure you have the proper permissions before scanning any system. For guidance on scanning individual files or systems, contact the Campus Privacy Office at privacyoffice@berkeley.edu.

Conditions of Use:

1. Licenses are tied to specific machines and cannot be transferred.
2. Single-machine licenses are restricted to local hard drives only.
3. Scanning shared drives or databases requires a departmental FTE license.
4. ISO reclaims and verifies the need for all licenses annually.
5. All scanning activity must comply with the Electronic Communications Policy (ECP).