Re: Sensitive Report Field "Mining" Tools

Are there any "freeware" tools out there that can aid in locating
instances within existing spool files where sensitive data may be exposed,
such as credit card numbers (regardless of the amount of masking done to the
16 digits), social security numbers, customer account numbers, pay rates,
etc.?

We (my current client) recently went through the process of obtaining
approval for the removal of *SPLFDTA from QAUDLVL (it is a heavy hitter to
the security journal receivers, after all) only to find that there are a few
reports that a developer is aware of that show SS numbers and pay rates in
the clear that probably should be monitored! We could always go the route
of securing the output queues with authorization lists and whittling down
our *SPLCTL special authority users as much as possible and then monitor
those that remain more closely as a mitigating control, but I think all
involved would rather know precisely where the sensitive data is exposed in
the report generation and distribution process and fix (change) how it's
handled. In fact, PCI compliance practically demands it.

I know of third-party tools like BCD's Catapult, that provides "the
ability to automatically create unlimited search indexes based on content in
the document such as PO number," but I'm sure that is based upon the fact
that you know which fields are present in the documents being searched. It
would take a LONG time to go through all of the output queues and their
spool files manually in an attempt to find the sensitive fields...

Any experience with this kind of thing or ideas?

Best regards,

Steven W. Martinson, CISA, CISM, CISSP
Security Consultant
Cypress, Texas

Smart-Consultant@xxxxxxxxxxxxx
Mobile: 713.277.5845
Fax: 281.758.2429
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.