Today I read a story appearing in the Des Moines Register, “Computer breach at UNI exposes some personal data” about a breach that occurred at one my alma maters, the University of Northern Iowa.
It bothered me the non-chalant way in which a computer breach was described as being “a pretty typical breach” by the Assoc. VP for Information Technology.
It makes it sound as though such breaches are to be expected. If appropriate safeguards are in place, though, these types of breaches should not occur.
This particular report is fairly short:
“The University of Northern Iowa is contacting students, faculty and staff who use the Wellness/Recreation Center about a security breach in a computer server that stored users’ names, addresses and phone numbers. The breach, discovered Dec. 26, occurred when someone outside UNI stored thousands of music files in a hidden folder on the server so that the music could be accessed from the Internet, said Steve Moon, acting associate vice president for information technology.
“This is a pretty typical breach,” Moon said. “People are looking for places to hide large files of music or movies that they can use or sell.”
An investigation revealed the music files started appearing in November, but did not reach noticeable size until late December, Moon said. An information
technology employee saw that a lot of system space had been consumed and found the hidden folder, he said. The music stored on the server took up more than 100 gigabytes of space, which can hold about 25,000 songs, computer technicians said. Moon said his technician didn’t know what type of music was on the server other than that “a 40-year-old man didn’t recognize any of the titles.”
The computer, used for checking users into the recreation center, contained the names, addresses and phone numbers of students, faculty and staff who use the facility. There is no evidence the intruder accessed the personal information, Moon said. The database does not contain users’ Social Security numbers, so there is little fear of identity theft, he said. “Fortunately, we’ve moved away from the protected information like Social Security numbers,” he said.”
If appropriate security was in place, a necessity for systems storing personally identifiable information (PII), this breach should not have occurred. The way it was recognized does not sound like it was even related to any type of intrusion detection process, but solely on a “hidden” file reaching a “noticeable” size.
Computer systems at universities are some of the most vulnerable, and most exploited, types of systems. Hopefully UNI will re-evaluate their security and update it to prevent this from happening again.
Tags: awareness and training, computer breach, Information Security, IT compliance, privacy, privacy breach