4 ms·

“ respectfully in terms of privacy rights and it is ABSOLUTELY never sold.” Could it be hacked? How good are university IT security operations?

by jdkee 7y ago

ineedasername 7y ago
At my school, they're surprising good. I mean, the systems aren't in an air gap, but we use 2FA, requests for data access are scrutinized, and not from a bureaucratic perspective but from a conversational perspective: "Let's talk about what you're trying to do with this data, what's the minimum needed for your goal? Is on-going access really necessary or can we provide a single extract that you access via a secure environment?" That sort of thing. Infrastructure security isn't something I'm involved with, but we do have a robust security team that works on it, that I engage with when working through vendor checklists and other security matters, and they are up to date on the field and conscientious to the point of (reasonable) paranoia. We're also not a high-profile target: Most hackers looking to crack a system holding personal data seem most concerned with high value targets with millions, not thousands of records. That doesn't stop our security team from treating the possibility with the utmost seriousness though. However, the above applies to where I work. This is not universally the case. I think most schools are increasingly aware of the potential, are take minimally necessary steps to make sure they aren't wide open, but there are simply too many small schools with 1,000 to 5,000 students that simply don't have the scale needed to really devote resources to this. Again, the low-value target helps here, but it's not great.
- crankylinuxuser 7y ago
  > We're also not a high-profile target Really now? Have you checked your school on Shodan recently? Long story short, there's enough people doing hacking, with varied enough interests. You don't know what makes someone else tick.

“ respectfully in terms of privacy rights and it is ABSOLUTELY never sold.” Could it be hacked? How good are university IT security operations?

by jdkee 7y ago

“ respectfully in terms of privacy rights and it is ABSOLUTELY never sold.” Could it be hacked? How good are university IT security operations?

ineedasername 7y ago

At my school, they're surprising good. I mean, the systems aren't in an air gap, but we use 2FA, requests for data access are scrutinized, and not from a bureaucratic perspective but from a conversational perspective: "Let's talk about what you're trying to do with this data, what's the minimum needed for your goal? Is on-going access really necessary or can we provide a single extract that you access via a secure environment?" That sort of thing. Infrastructure security isn't something I'm involved with, but we do have a robust security team that works on it, that I engage with when working through vendor checklists and other security matters, and they are up to date on the field and conscientious to the point of (reasonable) paranoia. We're also not a high-profile target: Most hackers looking to crack a system holding personal data seem most concerned with high value targets with millions, not thousands of records. That doesn't stop our security team from treating the possibility with the utmost seriousness though. However, the above applies to where I work. This is not universally the case. I think most schools are increasingly aware of the potential, are take minimally necessary steps to make sure they aren't wide open, but there are simply too many small schools with 1,000 to 5,000 students that simply don't have the scale needed to really devote resources to this. Again, the low-value target helps here, but it's not great.

crankylinuxuser 7y ago
> We're also not a high-profile target Really now? Have you checked your school on Shodan recently? Long story short, there's enough people doing hacking, with varied enough interests. You don't know what makes someone else tick.