Fingerprint

In data security, the word fingerprint covers three different things, and mixing them up leads to wrong policies. The idea is the same in every case: a short value is derived from something larger so that it can be recognized again later. What differs is what gets fingerprinted and how the value is built.

The first two meanings matter most for data loss prevention, because they recognize protected documents. The third describes systems, not documents, and serves identification and inventory.

A content fingerprint does not store the document itself. The method is built for material that has been edited or partly reused, which is exactly where simple file checks fail. In Anexet this method is set up as digital fingerprinting and runs in four stages.

The benefit is practical: an excerpt pasted into an email still matches its source, and a template made from an empty form matches every completed copy of it.

1. 1

   Normalize the text

   Remove formatting and reduce the document to comparable text, so layout changes do not affect the result.

2. 2

   Hash overlapping segments

   Compute hashes over overlapping pieces of the text. Only this set of values is stored.

3. 3

   Compare new content

   Outgoing email, uploads, and messages go through the same process and are compared with the stored set.

4. 4

   Act on the overlap

   A substantial overlap means protected material is present, and the rule blocks, logs or alerts.

A cryptographic hash is computed over the entire file, and the resulting value is stored in a hash bank. It answers one question with certainty: is this the same file, byte for byte? Hashes are cheap to compute and compare, and they produce no false positives.

That same precision is the limit. Saving a document in another format or changing one character produces a completely different value, so the match fails. Hashes work well as the first filter and for file integrity checking, but they cannot follow content that has been reworked.

Registered fingerprints are kept in data banks. The Fingerprints manager lists each bank with its size, document count, and last update date, so an administrator can see what is protected and how current the reference set is. A bank that is never updated protects an increasingly historical set of documents.

This meaning shares the metaphor but not the mechanism. A device or browser fingerprint is a profile built from observable traits such as hardware identifiers, installed components, screen and locale settings, and network attributes. Nothing is derived from protected content, and the subject is a system, not a document.

Defenders use it for device identification and endpoint inventory, for example, in hardware inventory. Attackers use the same kind of profile to track users without cookies, which is why the term needs a precise definition in any security program.

The methods complement each other. Hashes are the cheapest first filter, content fingerprints catch what editing would hide, and a dirty word list covers sensitive material that nobody registered in advance.

All fingerprinting methods are one-way. The original cannot practically be rebuilt from the derived value, so the detection system can recognize regulated content without keeping a second copy of it. That is a privacy advantage, and it is also why the reference set has to be maintained.

Fingerprints work only on data they can read. Content converted into an image needs text recognition first, and strongly encrypted or paraphrased content falls outside the match. They also do not describe every data exfiltration attempt, so they work best alongside other controls.

Start by registering the documents that would cause the most damage if they left the company, such as contracts, source code, and customer records. A bank built from those files recognizes copies that have been edited or reused.

Then review the bank regularly, because the reference set is only as current as its last registration.

Further reading: Encryption, coding and hashing – what is the difference?.