7

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing.

Currently i'm doing this manually with the usual tools like grep and some terrible reg-ex but a nice stand-alone application would be ideal. Especially something i can use the output of and drop in a report. If i query the files from a terminal looking for card-numbers, it spits them back out, which also means i have to redact them. Ideally I need a count and a list of 'anonymized card numbers' as well as which files they were in.

Any suggestions on alternate ways of finding this data or tools that can be used to achieve this would be most welcome.

Improve this question
2
  • Similar to this question -- security.stackexchange.com/questions/34902/… ?
    – atdre
    Commented Feb 28, 2015 at 18:18
  • I'm voting to close this question because it's only attracted worthless one-liner “use this product its great” (or “use this product its crap”!) answers. The question could probably be salvaged by an edit, but as it's already asking about methodology and not about tools, I'm at a loss as to how to edit it to get useful answers.
    – Gilles 'SO- stop being evil'
    Commented Jun 29, 2015 at 22:08

6 Answers 6

Reset to default
3

ccsrch is a tool for exactly this purpose. I have seen QSAs use this as part of their audits.

Personally, I'm not fond of it. I've run it against a file with 100k cards and it found all 50k of them. I got better hit rates with a python script I threw together in an afternoon. And the output requires lots of manual review to weed out false positives.

But, again, QSAs use it, and it's better than nothing.

Improve this answer
1
  • Thanks! Looks like its useful enough for what i'm doing right now. Has happily pulled 80k cards in a few short seconds from my test files. Pity it doesn't have an option to redact the output... :( None-the-less! Really appreciate the speedy answer as well!! Also, Disclaimer: I'm not a QSA!
    – NULLZ
    Commented Feb 28, 2015 at 15:41
1

From what I understand, you can find the data you need with tools like grep, but you are finding it difficult to deal with the resulting output because it, too, becomes sensitive data.

It appears that you need sed with your grep. Once you find offending data, you can pipe the result through a substitution process to create obfuscated card numbers.

But I'm not sure why you need to capture the card numbers at all. Grepping so that you know what files contain offending data should be enough, you can check for valid results by hand.

As for other PII, you are going to have to live with regex so that it meets your expected results. You can find other people's attempts at regex patterns to help you out.

Yes, you can get a variety of tools to help, but they all perform some form of grep|sed|awk and regex.

Improve this answer
0

There is a paid product called Identity Finder that will do just that. It can find a variety of PII, and produces a report that you can use. I am not affiliated with this product, I just use it at work.

Improve this answer
0

OpenDLP is another project widely touted -- http://opendlp.googlecode.com -- Another is MyDLP -- https://en.wikipedia.org/wiki/MyDLP

Improve this answer
0

I've had an auditor recommend Cornell Spider, which is just a hacked together tool that uses some regexp to look for things like SSN, PAN, etc... It works but isn't very polished.

Improve this answer
0

QuaSAr is a "for pay" product designed to do just this.

Disclaimer: I do not, nor have ever worked for confide, but have friends in the company.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .