Sensitive Data Discovery

data definition and discovery process

When a person is tasked with data anonymization the first thing s/he does is try to understand what subset of data s/he needs to address with masking. Basically, the first question is "what is sensitive data"?

the definition

The term "Sensitive Data" or "PII" (personally identifiable information" or "PHI" in heath, protected health information, stands for the data that describes a person in a specific way, with certain attributes. The knowledge of the values of these attributes allows other people to re-identify that specific person among other people.

For example, the knowledge of Social Security Number allows learning a lot of things about a person. Social Security Number invariably is used in multiple systems during this person's life and is unique. The SSN value in the wrong hands can lead to false credit card applications, fraud medical claims, and exposure of public information about students.

fraud

There is a black market for stolen PII PII. Each element has aits own price on the black market for-for the very reason that it helps to commitearn fraud. the money in illegal ways. Besides commercial vendors, FBI and other government law enforcement entities take issue very seriously. People committing fraud get harsh sentences

privacy

Thus,Even beforeif maskingnot activitieswith fraudulent intentions, compromising one's privacy is not desired. It is quite possible that a person would not want their employer, neighbours and sometimes even start,family one hasmembers to find allout about their health issues (https://www.fbi.gov/news/stories/2012/november/estate-planner-victimized-terminally-ill). Recent stolen data about extramarital affairs from Ashley Madison's site exposed a lot of people, and no matter how questionable the elementsethics thatof havethese anpeople abilityor tobehavior identifywas, it cost a personlot of ruined careers and even suicides (https://en.wikipedia.org/wiki/AshleyMadisondatabreach#Impactand_ethics)

Attributes domain

So, what defines a domain of sensitive data in aterms system.of Thisperson's attributes? The process of defining such domain is called "sensitive data discovery" and currently is defined in terms of discovering data in the systems across enterprise.