Find Restricted Information: SENF Tips

Overview

Do I even need to run SENF?

SENF is primarily for colleagues who don't think they have any restricted information and are looking for old archives of documents containing restricted information.

If you know that you receive or store restricted information on your computer

occasionally
temporarily
regularly

then you need encryption, not SENF. Contact the Information Security Office at x4040 for assistance with encryption.

What are SENF's limitations?

SENF often reports it has found a sensitive number, when it has not. In addition, if SENF reports no sensitive numbers found, there may in fact be some that it hasn't reported. These limitations are inherent in the large number of file formats and number formats that must be accounted for to recognize these numbers. In addition, files containing CWID (Campus-Wide ID) will set off a SENF report, because Pepperdine issues these 9 digit numbers in the same numeric range as valid SSN.

Why use SENF?

Use SENF to find files or folders that may contain sensitive numbers. This is primarily intended for when we are not aware of where we, our predecessors, our co-workers, or our computers have stored files with restricted numbers in them. In testing, SENF has found several files with sensitive numbers that the owner and department was unaware even existed.

For this campaign we are using SENF as a detector or triage tool. It quickly reports where there are or may be files with SSN/CCN data. It allows speedy human access for verification of those reports (by clicking the reported files to get a preview of the contents).

Why not a different program?

A study by a member of the security staff at UC Boulder in 2007 showed that SENF found these sensitive numbers as well or better than programs with $50-$250,000 license costs or the other free scanner (SPIder) developed by Cornell. The cost, accuracy, speed, and platform support of SENF commends it for use in this campaign.

Additional Tips (updated 3/2/09)

False positive matches for restricted numbers will occur. You must use your judgment as to which files actually contain restricted data. SENF is a detector to help you find unknown or forgotten restricted data; it can be tricked by valid restricted number strings that occur randomly in files. Many times you can tell by the file name or the preview that SENF has found something that is a valid sequence, but not a real SSN or CCN. Skip over such files or groups of files, if you can tell that they don't really contain restricted information.
Clear out temporary files before running SENF on your local computer's hard drive.
- Empty your Recycle Bin or Trash (see operating system help).
- Clear Windows Temp files
  - Open Disk Cleanup by clicking the Start button, clicking All Programs, clicking Accessories, clicking System Tools, and then clicking Disk Cleanup.
  - Select to clean up your entire disk.
  - Make sure that ONLY entries for "Temporary" items are selected for cleanup before you click "Delete Files" (Vista) or OK (XP).
Print out a control list, if you find many valid matches. You may wish to print out the log of a SENF scan to use as a control list or checklist of files that SENF found. This way you can mark the list and make sure you handled all the files containing valid restricted data.

Here are the steps to print out SENF's log:
1. Launch SENF again, and complete a scan of your drive.
2. Find the folder where you launched SENF, and look for a file named in this format:
  YYYYMMDDHH.txt or YYYYMMDDHH_N.txt
  where YYYY is the year, MM the month, DD the day, and HH is the hour at which you ran SENF. Subsequent runs in that same hour will have _N appended where N is a serial number.
  - Example - you ran SENF at 4PM March 2nd, 2009, so it creates a log for that run called:
    2009030216.txt
3. Open the log file in Notepad or Text Edit and print it.
4. Now as you preview the files from this and subsequent runs, you can make notes as to which files you've reviewed, want to delete, and so forth.