If you received an automated email from data-security@case.edu, Cyera identified a file or folder that you own or manage that may contain sensitive information, may be shared more broadly than appropriate, or otherwise needs review. The notification will identify the item that needs your attention and provide information about the issue. Automated classification is not perfect, so if you believe the finding is incorrect or the current sharing is required for a legitimate university purpose, contact data-security@case.edu for assistance. CWRU Office of Information Security will never ask you to provide your password or MFA code in response to a Cyera notification.
Cyera is a data security service CWRU uses to help identify sensitive information and risky sharing in supported university cloud storage services. Cyera automatically scans and classifies files for information that may be sensitive, such as Social Security numbers, financial information, or health information. It also reviews sharing and access settings to help identify files or folders that may be accessible to more people than intended. A Cyera finding does not necessarily mean that a security incident has occurred. It means the file or folder may need to be reviewed to make sure the information is stored appropriately and shared only with people who need access.
Securing your file or folder usually only takes a few minutes. If you received a Cyera notification:
1. Review the findings. The email will identify the file or folder that needs attention and explain why it was flagged.
2. Confirm who needs access. Determine whether the current sharing is required for university business. Remember that access may be inherited from a parent folder or Shared Drive.
3. Correct unnecessary access. If access is broader than necessary, remove public links, organization wide access, unnecessary external users, or other permissions that are no longer required. Share the information only with the people who have a legitimate need for access.
4. Consider the type of information. Changing sharing permissions may not be enough if sensitive or Restricted Information is stored in a location that is not approved for that type of data. Use the storage guidance below or contact data-security@case.edu if you are unsure.
5. Do not delete university information solely because it was flagged. If the information is no longer needed, follow applicable university records-retention, legal, research, and departmental requirements before deleting it.
We Are Here to Help
If you are unsure how to address a finding, believe the notification was sent in error, or are not sure whether the current storage or sharing is appropriate, contact CWRU Data Security at data-security@case.edu. Please include the Cyera notification or the name of the affected file or folder so we can help investigate the finding. Please do not email or attach the sensitive information itself.