Private Yale Student Info Accessible via Google Search

While we're normally flooded with news about hackers who routinely bypass security systems and exploit zero-day vulnerabilities to gain access to sensitive systems, recent news from Yale University underscores that the vast majority of IT security failures are caused by human error, neglect, or plain ignorance. I've written about how users are often the weakest link in IT security, but that maxim can apply to simple human error in general.

According to the Yale student newspaper, the University is notifying 43,000 staff, students, and alumni that sensitive personal information -- like names and social security numbers -- were inadvertently made accessible to internet searches when a file containing that information was left unprotected and unsecured on an FTP server that was used as a storage location for open source software.

Zoe Gorman at the Yale Daily News interviewed Yale Information Technology Services (ITS) Director Len Peters, and he pointed to a 2010 change in Google search that allowed the popular search engine to locate and index content on FTP servers. Peters said that the Yale ITS wasn't aware that Google made the change, which resulted in the file now being accessible through Google search.

Yale University spokesman Tom Conroy released a statement about the incident, which describes measures the university will take to rectify the data breach and help prevent the individuals impacted from being victims of identify theft and other security-related ills. "Yale has established a Response Center for affected individuals and is offering free credit monitoring, identity theft insurance, and other assistance to all of the affected persons," Conroy said. "A data security firm will monitor credit files at all three major United States credit bureaus for 24 months and alert individuals if a new United States credit account is opened using their Social Security number. The University takes seriously the obligation to protect personal data that is entrusted to it, and regrets the error that made the computer file accessible."

This episode underscores that even the most secure systems can be undermined by human error or miscommunication. Have any thoughts on the state of IT security at colleges and universities these days? Add a comment to this blog post or start up a discussion on Twitter.

Related Content: