10

I'm looking for well known tools that will scan for any PII within a network. For example, I would like to be able to use a plug and play method, meaning I drive to a client, plug my laptop in, and scan for all sensitive material, such as SSN, Account numbers, medical records, etc. I believe I'm looking for a "portable" DLP system. Currently, I have come across, Find_SSN, Sensitive Number Finder (SENF), Spider, Identity Finder. Any thoughts? In addition, I've read about FTK toolkit and EnCase, but not quite sure if they would perform the way I'm hoping them to. Essentially, I would like these tools to perform similar to any VA tool, such as Nessus, LANguard, OpenVAS, etc., but scan for PII.

Improve this question
2
  • An "all in one" tool just for scanning for PII. I'm not asking for one tool for VA and PII. I don't see how this is "strange" when someone is contracted to scan for PII as part of the process to become compliant. For example, a VA tool would scan for all sorts of vulnerabilities across various software, I was checking to see if there was a PII scanning tool that could do the same. Scan different extensions for PII as a plug and play device.
    – Pentest
    Oct 27, 2011 at 12:47
  • Dead link :( Sad times.
    – OutOfThisPlanet
    Aug 30, 2018 at 14:34

2 Answers 2

Reset to default
5

Try http://code.google.com/p/opendlp/

OpenDLP is a free and open source, agent- and agentless-based, centrally-managed, massively distributable data loss prevention tool released under the GPL. Given appropriate Windows, UNIX, MySQL, or MSSQL credentials, OpenDLP can simultaneously identify sensitive data at rest on hundreds or thousands of Microsoft Windows systems, UNIX systems, MySQL databases, or MSSQL databases from a centralized web application. OpenDLP has two components:

Improve this answer
1
  • Thank you everyone. Will give both Nessus compliance and OpenDLP a good look.
    – Pentest
    Oct 27, 2011 at 16:31
3

You may well be able to use Nessus for this. Nessus Compliance checks apparently have the ability to scan for strings inside windows files. I've not actually used that side of their compliance checks, but the general process of using nessus for credentialed checks works reasonably well, in my experience.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .