Digital Fingerprint

A digital fingerprint is a compact set of values derived from a protected document's content. The organization keeps this set instead of a copy of the document, and uses it to recognize that content wherever it appears later.

Fingerprints are one of the recognition methods in data loss prevention (DLP) systems. The difference is the target. A fingerprint looks for the material itself, so a copy, an excerpt or a reformatted version still matches.

The method has two phases. Registration runs once for each protected document, and inspection runs whenever content leaves the organization, as in Anexet's digital fingerprinting.

1. 1

   Normalize the text

   The document is reduced to comparable text, so formatting changes and a different file format have less effect on the result.

2. 2

   Compute overlapping segments

   Hashes are calculated over overlapping segments of the normalized text, sometimes combined with structural features.

3. 3

   Store only the values

   The library keeps the derived values, not the document. Candidate content goes through the same calculation later.

4. 4

   Compare the share of matches

   A high share of matching values shows that the candidate contains the protected material, even when only one section was copied.

Hashes, fingerprints, and keyword rules answer different questions. Mature deployments use all three: hashes for known files, fingerprints for the most important documents, and patterns and keyword lists for the rest.

A variant registers the blank form instead of a filled copy, such as a claims form, an application or a standard agreement. Every completed copy of that form then matches, so large families of records are protected without registering each one. This works best for structured documents, where layout and standard text stay stable and only the variable fields change, especially when the records hold sensitive information.

Fingerprint libraries are managed in the Anexet DLP console, which shows what is registered and when each library was last refreshed.

1 / 2

• 
• 

A fingerprint is only as good as the list of registered material behind it. Tune the threshold on a sample of ordinary work before enabling blocking, because a match can drive a content-aware blocking rule.

• A fingerprint recognizes only material registered in advance. Someone has to choose what to protect and keep the registration current.
• Heavy paraphrasing, translation and content retyped from scratch fall below the matching threshold.
• Very short excerpts are ambiguous, so thresholds need a minimum amount of shared content, not a single segment.
• Screenshots and scans need text recognition before a fingerprint can be computed.

Start with the documents whose copies would do the most damage, such as contract templates, product designs, and client registers. A library of everything is slow to maintain and gets ignored, while a small, current set keeps its value.

Further reading: Encryption, coding and hashing – what is the difference?.