Mitigating insecure digital storage of sensitive information

An apparatus comprising:

• at least one processor;
• memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
• detect a transfer of data from one application to another, the transfer including a field to receive sensitive information, wherein to detect the transfer:
• set a paste listener for a window or a document;
• and
• using the paste listener, detect that a field within the window or the document has been modified by adding hidden characters, wherein the detection is based on comparing values of the window or the document between transfer operations;
• determine that the one application of the transfer is insecure;
• in response to the processor determining that the one application is insecure:
• provide a plurality of actions so as to mitigate use of sensitive information within the one application, wherein the plurality of actions comprise a first action and a subsequent second action, wherein the first action is based in response to determining that a user has performed a first threshold number of transfer of sensitive information, wherein the subsequent second action is based in response to determining that the user has performed a second threshold number of transfer of sensitive information, wherein the second threshold is higher than the first threshold.

A method comprising:

• receiving, by an analytic server from a client computing device, data associated with a transfer of sensitive information at the client computing device, the data comprising identification of:
• a user associated with the client computing device, a source application for the transfer, a target application for the transfer, information type of the sensitive information, and client computing device type, and paste information type;
• generating, by the analytic server, a risk score associated with the transfer based on the received data;
• generating, by the analytic server, plurality of actions based on the generated risk score and the received data;
• and
• transmitting, by the analytic server to the client computing device, the one or more actions, wherein the plurality of actions comprise a first action and a subsequent second action, wherein the transmitting comprises:
• transmitting, by the analytic server to the client computing device, the first action in response to determining that the user has performed a first threshold number of transfer of sensitive information;
• and
• transmitting, by the analytic server to the client computing device, the subsequent second action in response to determining that the user has performed a second threshold number of transfer of sensitive information, wherein the second threshold is higher than the first threshold.