News Feature
Once More unto the Breach
The announcement earlier this month of a potential data security breach at the University of California, San Francisco (UCSF) may have come as a shock to the 46,000 individuals who received notification that their personal information might have been compromised. But for industry observers, this latest revelation was just another in a long string of security incidents impacting institutions of higher learning.
Higher ed isn't the only sector suffering from breaches in security, but it is, in some ways, in a unique predicament. Adam Thermos, founder of
Strategic Technology Group
, said that universities typically implement standard security measures. "However," he said, "this is [academia].... Most of the problems are more out of negligence and less out of malice. Too much instability in operations, too many work study and graduate students in and out, too many cooks in the kitchen...."
Regardless of the causes--and it should be noted that the specific cause of the UCSF breach is not known publicly, if at all, as of this writing--data breaches in higher education are more common than in most other sectors. Are higher education institutions doing all that can be done to safeguard the personal data of their students, employees, and customers? And, when breaches do occur, are the universities doing everything they're supposed to be doing?
We spoke with a number of analysts and industry observers on this issue in light of the UCSF incident. For the most part, they agreed that higher education is doing well in many cases when it comes to responding to incidents; but efforts at safeguarding data leave something to be desired, especially given some obvious and relatively unobtrusive measures that could be adopted.
What Happened at UCSF?
In March, UCSF discovered that a file server located at the University of California Office of the President in Oakland, CA might have been accessed electronically by an unauthorized, as-yet-unidentified entity. The server itself contained information on staff, students and faculty at UCSF and the UCSF Medical Center--including Social Security numbers and bank account information related to payroll and "reimbursement deposits."