Private Yale Student Info Accessible via Google Search


While we're normally flooded with news about hackers who routinely bypass security systems and exploit zero-day vulnerabilities to gain access to sensitive systems, recent news from Yale University underscores that the vast majority of IT security failures are caused by human error, neglect, or plain ignorance. I've written about how users are often the weakest link in IT security, but that maxim can apply to simple human error in general.


Yale University Security

According to the Yale student newspaper, the University is notifying 43,000 staff, students, and alumni that sensitive personal information -- like names and social security numbers -- were inadvertently made accessible to internet searches when a file containing that information was left unprotected and unsecured on an FTP server that was used as a storage location for open source software.

Zoe Gorman at the Yale Daily News interviewed Yale Information Technology Services (ITS) Director Len Peters, and he pointed to a 2010 change in Google search that allowed the popular search engine to locate and index content on FTP servers. Peters said that the Yale ITS wasn't aware that Google made the change, which resulted in the file now being accessible through Google search.

Yale University spokesman Tom Conroy released a statement about the incident, which describes measures the university will take to rectify the data breach and help prevent the individuals impacted from being victims of identify theft and other security-related ills. "Yale has established a Response Center for affected individuals and is offering free credit monitoring, identity theft insurance, and other assistance to all of the affected persons," Conroy said. "A data security firm will monitor credit files at all three major United States credit bureaus for 24 months and alert individuals if a new United States credit account is opened using their Social Security number. The University takes seriously the obligation to protect personal data that is entrusted to it, and regrets the error that made the computer file accessible."

This episode underscores that even the most secure systems can be undermined by human error or miscommunication. Have any thoughts on the state of IT security at colleges and universities these days? Add a comment to this blog post or start up a discussion on Twitter.

Related Content:

Discuss this Blog Entry 1

on Aug 25, 2011
You nailed it, the weakest link in any security setup is the human link. No matter how strong the security that is setup to prevent the breaches, someone - usually with good intentions - will find a way to subvert it. In the course of the forensics conducted on this particular SNAFU, hopefully the reason that a file containing this sensitive data was placed on an FTP server in the first place was highlighted and the individual(s) disciplined.

Please or Register to post comments.

What's Security Blog?

Security news, views, product reviews, and solutions for Microsoft Windows IT professionals.

Blog Archive

Sponsored Introduction Continue on to (or wait seconds) ×