4 ms·

How many times has the UC system been breached now? There were three breaches in 2014-15: https://www.networkworld.com/article/3039116/uc-berkeley-makes-third-

How many times has the UC system been breached now? There were three breaches in 2014-15: https://www.networkworld.com/article/3039116/uc-berkeley-makes-third-data-breach-disclosure-in-past-15-months.html https://www.networkworld.com/article/3039116/uc-berkeley-mak... There was a massive one back in 2009: https://www.networkworld.com/article/2254411/160-000-student--alumni-accounts-breached-at-uc-berkeley.html https://www.networkworld.com/article/2254411/160-000-student... There was a 2006 breach involving the DoE labs managed by UC: https://www.networkworld.com/article/2292688/university-hit-with-proposed--3m-fine-for-breach.html https://www.networkworld.com/article/2292688/university-hit-... And that’s just what I dug up on UC Berkeley in a few minutes. At what point do we start saying “no” to anyone requesting personal information? If a university known for its computer science programs can’t keep this info secure, how can we trust our doctors, insurance companies, landlords, and so on to get security right?

babesh 6y ago
IT departments at universities are generally not bastions of competence. This was exacerbated by private sector compensation greatly exceeding compensation at universities the last twenty years. You really do not want to know what passes for IT at universities even as renowned as Stanford or Berkeley.
secabeen 6y ago
This wasn't a breach of UC, it was a vendor that UC used. Somewhat different.
gnulinux 6y ago
Because EECS staff (grad students, professors) don't maintain the IT infrastructure of UC Berkeley?
angry_octet 6y ago
This is the Accellion breach, not a problem with their internal systems. This box is used for 'secure' large data transfer. Like a Dropbox appliance basically. Except Accellion write rubbish software and the devices were ruthlessly shelled. Insert :Cheeto lock: meme. Arguably, the hundreds of Accellion clients should have separately encrypted their data and used some sort of PKI to exchange public keys. But try getting users to do that properly. Unfortunately, since Broadcom bought Symantec there hasn't been any good PGP solution for corporate file exchange.

babesh 6y ago

IT departments at universities are generally not bastions of competence. This was exacerbated by private sector compensation greatly exceeding compensation at universities the last twenty years. You really do not want to know what passes for IT at universities even as renowned as Stanford or Berkeley.

secabeen 6y ago

This wasn't a breach of UC, it was a vendor that UC used. Somewhat different.

gnulinux 6y ago

Because EECS staff (grad students, professors) don't maintain the IT infrastructure of UC Berkeley?

angry_octet 6y ago

This is the Accellion breach, not a problem with their internal systems. This box is used for 'secure' large data transfer. Like a Dropbox appliance basically. Except Accellion write rubbish software and the devices were ruthlessly shelled. Insert :Cheeto lock: meme. Arguably, the hundreds of Accellion clients should have separately encrypted their data and used some sort of PKI to exchange public keys. But try getting users to do that properly. Unfortunately, since Broadcom bought Symantec there hasn't been any good PGP solution for corporate file exchange.