System and method for detecting and mitigating the writing of sensitive data to memory

• US 20090055889A1
• Filed: 04/11/2008
• Published: 02/26/2009
• Est. Priority Date: 04/12/2007
• Status: Abandoned Application

• Current Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Original Assignee: Trustwave Corporation (Singapore Telecommunications Limited)
• Inventors: Green, Kenneth, Carlson, Jacob
• Application Number:
  US12/081,247
• Publication Number:
  US 20090055889A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

Disclosed is a system and method for detecting and mitigating the writing of sensitive or prohibited information to memory or communication media. The method includes detecting if an application is to write data to a memory, rerouting the writing of that data, and scanning the data for sensitive content or prohibited information. The scanning is done in accordance with one or more information security policies. If sensitive information is detected, the system has the option of issuing an alarm and/or preventing the sensitive information from being written, depending on the security policy. If the system permits the sensitive information to be written to memory, the system may spawn a file watcher object, which waits for a specified amount of time and then checks to see if the sensitive information has been deleted. If not, the system may issue an alarm or erase the sensitive information, depending on the security policy.

Claims

1. A method for detecting an attempt to write sensitive data to a memory, comprising:

detecting that an application has a function to write data to the memory;

rerouting the writing of the data to a separate memory location;

scanning the data for sensitive data content;

identifying sensitive data content within the data;

querying at least one security policy for an instruction whether to permit writing of the sensitive data content to the memory;

permitting the application to write the sensitive data content to the memory, depending on the at least one security policy;

waiting for an amount of time specified by the at least one security policy; and

determining if the sensitive data content is present in the memory after the amount of time.

2. The method of claim 1, wherein identifying the sensitive data content comprises issuing an alert.

3. The method of claim 1, wherein determining if the sensitive data content is present in the memory comprises issuing an alert if the sensitive data content is present.

4. The method of claim 1, wherein determining if the sensitive data content is present in the memory comprises erasing the sensitive data content.

5. The method of claim 1, wherein the waiting for the amount of time is based upon a retention time of the at least one security policy.

6. A computer readable medium encoded with instructions for detecting an attempt to write sensitive data to a memory, the instructions comprising:

detecting that an application has a function to write data to the memory;

rerouting the writing of the data to a separate memory location;

scanning the data for sensitive data content;

identifying the sensitive data content within the data;

querying at least one security policy for an instruction whether to permit writing of the sensitive data content to the memory;

permitting the application to write the sensitive data content to the memory, depending on the at least one security policy;

waiting for an amount of time specified by the at least one security policy; and

determining if the sensitive data content is present in the memory after the amount of time.

7. The computer readable medium of claim 6, wherein identifying the sensitive data content comprises issuing an alert.

8. The computer readable medium of claim 6, wherein determining if the sensitive data content is present in the memory comprises issuing an alert if the sensitive date content is present.

9. The computer readable medium of claim 6, wherein determining if the sensitive data content is present in the memory comprises erasing the sensitive data content.

10. The computer readable medium of claim 6, wherein the waiting for the amount of time is based upon a retention time of the at least one security policy.