Identity Finder is software that allows organizations and individuals to know where certain types of data are and in what concentrations. Identity Finder scans files for defined types of data and reports where it finds it and the type of data.

Identity Finder will be configured to search for social security numbers, credit card numbers and passwords. These are not the only types of sensitive data the university works with but they are two pieces that have serious consequences for us and the individual in the event confidentiality is lost. In an effort to not duplicate sensitive data the data is not replicated in reporting logs.

In 2009 Alaska enacted a personal data breach law restricting use of some types of personal data about an individual. It also requires notification in the event of a breach of confidentiality (Alaska Stat. § 45.48.010 et seq.). To protect personal information and meet legal and regulatory requirements the university needs to know what kind of sensitive information we have and where it is. Identity Finder will provide that information, it will give us better data to base decisions regarding sensitive data on, speed up investigation in the event of an incident and support a safer computing environment much like anti-virus does.

Currently scan results will be reported to OIT Security Administration who will generate reports on where sensitive data resides in the computing environment to guide risk mitigation activities while allowing management the ability be better gauge and accept risk. You will have the ability to run a manual scan if you would like to see what kind of sensitive data exists on the computer and in what quantity. In the event of an incident this reporting will be used to determine exposure level and necessary action on an individual system basis. Identity Finder does not report to the software vendor or anyone outside the university.

No. Often workstations and laptops get re-purposed, passed on or used by more then one person each with different uses and knowledge of what is present on the computer. It is also common for this type of information to be stored in hidden or temporary files individuals are not aware of when entering the data for transmission. Additionally judging risk and accepting it needs to be a continuous process and not a one time scan in order for it to be accurate in the event of an incident.

Yes. In the past the university has allowed incidental personal use of computing resources that is not for personal financial gain or partisan political activity. Any results regarding personal information about you would be a good opportunity to ask yourself if (1) you still need this data on a university computer and (2) if you are willing to accept responsibility for its loss or theft. If the answers are yes consider Identity Finder notifications a friendly reminder of the risks. If the answer is no consider your options for removing the data.

Forty-six states, the District of Columbia, Puerto Rico and the U.S. Virgin Islands have data breach notification laws and more are adopting them with that many institutions have moved to scanning for sensitive data and maintaining an inventory of it. Identity Finder is used by Cornell, University of Virginia, and University of Iowa to name a few.

If you have questions not addressed here you can contact the OIT Support Center via email at helpdesk@alaska.edu, on the web at https://service.alaska.edu/selfservice or phone at 907-450-8300 or toll free 1-800-478-8226. Additional questions asked with high frequency will be added to this FAQ as well.