Spirion (formerly Identity Finder) Scanning         

Overview

Data breaches are often big news and can be very costly to an organization.  Spirion is an application designed to find personally identifiable information (referred to as “PII” or "Level 1 Protected Data") stored on your campus computer and to provide you with a way to securely remove this data. "Protected Data/PII" is defined as data that must be protected from unauthorized access. 

Keeping protected data on your computer can put you, the campus, and particularly our students at high risk for identity theft. 

What is Spirion?

Spirion is a “Data Loss Prevention (DLP)” program that locates Protected Level 1 data (personally identifiable information or "PII" as well as electronic health information or "ePHI") in a variety of files such as Word, Excel, PDF, or email messages. In addition to locating Protected Level 1 data (PII, ePHI), Identity Finder can apply a set of actions to locations that have been identified as containing Protected Level 1 data. Such actions include the ability to delete (Shred), redact (Quarantine), and archive your results in order to protect yourself (or others) from identity theft.

What does Spirion search?

The Spirion tool will find and assist you with protecting Level 1 Protected Data (PII, ePHI), or other data elements that can be used for identity theft. Access to this data would allow someone to steal your identity by obtaining individual pieces of data, or by using multiple pieces of data in combination with each other. Such data includes:

  • Social Security Numbers
  • Credit Card Numbers
  • Passwords
  • Bank Account Numbers
  • Driver License Numbers
  • Dates of Birth

The types of files that Spirion can search for include Microsoft (Word, Excel, Access, PowerPoint etc.), Adobe (PDF), text files, web files and other common file types. Spirion also searches through compressed files, Exchange mailboxes (including attachments), Outlook profiles, and .pst files as well as some popular cloud storage provider directories stored on your machines (Dropbox, Box, Google Drive etc.).

Such data can come from a broad range of activities and records including the following:

  • Old Class Rosters
  • Old Student Time Sheets
  • Demographics data and records requested by federal agencies or professional organizations
  • Human Resource Records
  • Student Reporting

Information Security recommends destroying any confidential information which is no longer needed, or moving such data to a secure folder location on the campus file share.

Where does Spirion search?

Spirion will search through specific folders in your computer's hard drive for Protected Level 1 data. These include, but are not limited to:

  • Local user folders (Documents, Desktop, Downloads, Music, etc.)
  • Web Browsers (saved passwords, browser cache, Favorites/Bookmarks, etc.)
  • Outlook Email and attachments
  • Windows Registry

Spirion will not search folders reserved by the Operating System, such as C:\Program Files or C:\Windows, as these are typically write-protected and require admin privileges to access.

Channel Islands and its employees are responsible for PII/ePHI for individuals that is collected and stored. If you have a question about the data you are storing, and whether you should be storing it, please ask your manager.

For future reference, our “Quick Scanning Guide” can assist you in launching, searching, shredding, ignoring, and saving results.

A few items to be aware of:

  • We recommend you schedule your first scan to run overnight or over the weekend, as it can be a long process the first time through.
  • Don't forget to lock your computer screen by pressing the Windows key and L (PCs), Ctrl-Shift-Power (Mac laptops), or Ctrl-Shift-Eject (Mac desktops).
  • All files stored on your computer will be scanned. However, encrypted files will be ignored.

CFA & CSUEU Review

CSU labor relations and system-wide Information Security reviewed the Spirion deployment, and has recognized the importance and the value of this implementation to our security process.

“The parties to this agreement, (CSU) and CFA, agree that data breaches are detrimental to all and agree that CSU may proceed with its implementation of … Spirion, subject to documented conditions.”

CFA - “The parties acknowledge the importance of working together to ensure the security of data used and stored on CSU system.”

CSUEU - “The parties acknowledge that CSU is required by law and CSU policy to monitor and protect the security of data used and stored on its systems and acknowledge the importance of working together to ensure the security of the data.”

Policy

Policy 8065.0 - Information Asset Management from the Information Security Policy section of the Integrated CSU Administrative Manual