2KKUU7ita

314
Part V: Hacking Applications
Figure 15-4:
Using
Identity
Finder to
uncover
hundreds
of sensitive
records
on an
unprotected
storage
device.
To speed the process, you can use Identity Finder, a really neat tool designed
for the very purpose of scanning storage devices for sensitive, personally
identifiable information. It can also search inside binary files such as PDFs.
Figure 15-4 shows what such a tool can find in just a matter of minutes.
Identity Finder has an Enterprise edition that you can use to search network
systems and even databases for sensitive information.
For a second round of testing, you could perform your searches logged in
as an administrator. You’re likely to find a lot of sensitive information scattered
about. It seems worthless at first; however, this can highlight sensitive
information stored in places it shouldn’t be or that the network administrator
shouldn’t have access to.
Testing is highly dependent on timing, searching for the right keywords, and
looking at the right systems on the network. You likely won’t root out every
single bit of sensitive information, but this effort will show you where certain
problems are, which will help you to justify the need for stronger access controls
and better IT and security management processes.