New York Data Loss Prevention User Group

 View Only
  • 1.  Having a problem with EDMs and Context

    Posted Jun 11, 2010 10:59 AM

    We have recently had a spate of False Positives in a EDM policy that has Last Name and Policy #.
    The false positives have been last name and $amount where $amount = policy number.

    Does anyone know how to write an exclude where Name+Policy hits but Name +$Policy does not hit.

    I need it in that context with a "$" in front of the policy number.

     



  • 2.  RE: Having a problem with EDMs and Context

    Posted Jun 13, 2010 11:54 PM
    We run into this as well.. although a little different...

    Think last name + SSN, with a large universe of EDM SSN... Think stock statements, and think of a common last name, like Mr. Johnson, and then a common equity, say, Johnson & Johnson, and then the collisions with
    123,456,789 units of stock (J&J) where the units collide with an actual SSN for someone with that last name...
    I have thought about bringing first name into it in some way to address this.

    Would be nice to combine data identifier and edm in one rule to help with stuff like this...