Database Journal
MS SQL Oracle DB2 Access MySQL PostgreSQL Sybase PHP SQL Etc SQL Scripts & Samples Links Database Forum

» Database Journal Home
» Database Articles
» Database Tutorials
MS SQL
Oracle
DB2
MS Access
MySQL
» RESOURCES
Database Tools
SQL Scripts & Samples
Links
» Database Forum
» Sitemap
Free Newsletters:
DatabaseDaily  
News Via RSS Feed


follow us on Twitter
Database Journal |DBA Support |SQLCourse |SQLCourse2
 

Posted Dec 30, 2009

Malicious attack exposes some 30,000 social security numbers at Penn State University

By DatabaseJournal.com Staff

Quite simply some 30,000 social security numbers at Penn State University (PSU) became vulnerable after a malicious software attack. Said a spokeswoman for PSU, "We're not sure if the data was accessed" and "The Social Security numbers were in archived files that people didn't realize were on their computers,"

And because of the 2006 state Breach of Personal Information Notification Act, PSU is mandated to notify anyone whose personally identifiable information is potentially disclosed when a computer is lost or compromised. This they are doing for those affected at the Eberly College of Science and the College of Health and Human Development.

Obviously the two breaches back in 2008 and the other “protection” methods deployed in that same year did nothing to help aid in this particular breach as the school is still trying to determine whose numbers were exposed. Josh Shaul, vice president of product management for Application Security Inc., a New York-based company that specializes in database security said about this breach that "Unfortunately, a majority of organizations that are as large and as longstanding as Penn State are in the same situation” and that “Younger organizations build information technology infrastructure with today's security threats in mind”.

Additinally, Shaul states that “organizations must first protect data they know exist. Second, officials must search for data that could be in unknown places. Finally, officials must establish a system to keep data, known and unknown, within the organizations' networks.”

Interesting quotes as it seems that PSU did try and take measures in 2008 AND I’d venture to say that many new, as well as old, organizations have no idea where all their sensitive data exists within their company. Maybe it’s time we start deploying intelligent mechanisms that detect who, what, and when malicious activity occurs on our networks.

View Article

Daily News Archives

Comment and Contribute

 


(Maximum characters: 1200). You have characters left.