Sensitive data movement detection
AssigneeCode 42 Software, Inc.
InventorScott Straw
Life of this patent
Estimating the term…
Abstract
Systems and techniques for sensitive data movement detection are described herein. An attempt to relocate a file that is a member of a monitored data set may be identified. A user account associated with the attempt to relocate the file may be determined. A safe user group may be identified for the user account associated with the attempt to relocate the file. A destination may be obtained for the attempt to relocate the file. A safe zone may be determined for the monitored data set using the user account and the identification of the monitored data set. A notification may be provided based on the destination for the attempt to relocate the file and the safe user group and the safe zone.
Claims20
A system for data set movement monitoring, the system comprising:
- at least one processor;
- and
- memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
- receive a request to establish a monitored data set corresponding to a data directory;
- gather file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;
- generate a security container that includes files in the data directory identified based on the sensitivity level;
- create a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;
- identify an attempt to relocate the file that is a member of the monitored data set;
- determine a user account associated with the attempt to relocate the file;
- identify a safe user group for the user account associated with the attempt to relocate the file;
- obtain a destination for the attempt to relocate the file;
- determine a safe zone for the monitored data set using the user account and the identification of the monitored data set;
- and
- provide a notification based on the destination for the attempt to relocate the file and the safe user group and the safe zone.
At least one non-transitory machine-readable medium including instructions for a file manager including data set movement monitoring that, when executed by at least one processor, cause the at least one processor to perform operations to:
- receive a request to establish a monitored data set corresponding to a data directory;
- gather file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;
- generate a. security container that includes files in the data directory identified based on the sensitivity level;
- create a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;
- identify an attempt to relocate the file that is a member of the monitored data set;
- determine a user account associated with the attempt to relocate the file;
- identify a safe user group for the user account associated with the attempt to relocate the file;
- obtain a destination for the attempt to relocate the file;
- determine a safe zone for the monitored data set using the user account and the identification of the monitored data set;
- and
- provide a notification based on the destination for the attempt to relocate the file and the safe user group and the safe zone.
A method for a file manager including data set movement monitoring, the method comprising:
- receiving a request to establish a monitored data set corresponding to a data directory;
- gathering file data including a set of risk indicators that indicate a sensitivity level for files in the data directory;
- generating a security container that includes files in the data directory identified based on the sensitivity level;
- creating a log of file names, a file-data string table, and a hash log for the monitored data set including hash values for files included in the security container using the file data;
- identifying, by the file manager, an attempt to relocate a file that is a member of a monitored data set;
- determining, by the file manager, a user account associated with the attempt to relocate the file;
- identifying a safe user group for the user account associated with the attempt to relocate the file;
- obtaining, by the file manager, a. destination for the attempt to relocate the file;
- determining a safe zone for the monitored data set using the user account and the identification of the monitored data set;
- and
- providing a notification via the file manager based on the destination for the attempt to relocate the file and the safe user group and the safe zone.
Dependencies are inferred from the claim text.