Not a week goes by without a computer breach being reported in the press: stolen laptops containing Social Security numbers, credit card numbers lost to hackers and other breaches that expose people's personal nonpublic information (PNPI) to abuse or misuse and the risk of identity theft. Privacy and proper handling of sensitive personal information is a continuing concern.
As the news reports tell us, higher education institutions are too often victims of information security breaches. Some recent examples:
- At Penn State, a university laptop containing archived information and Social Security numbers for 677 students attending Penn State between 1999 and 2004 was stolen from a faculty member (Jan 25, 2008);
- At the University of Wisconsin-Madison, the personal information, including e-mail addresses, phone numbers, Social Security numbers and campus ID numbers of faculty and staff had been accessible on a campus Internet site (Jan 16, 2008); and
- In November 2007, Montana State University reported three breaches in a single day--one stolen laptop and two Web sites that contained names and Social Security numbers.
Since 2005, UD Information Technologies (IT) has spearheaded a University-wide initiative to protect PNPI, including individual consultations with every University department. With the conversion to UDSIS, the transition from Social Security numbers to UD IDs as a university identifiers is complete.
While Social Security numbers have been eliminated from central information systems except where required by law or needed for core business activities, IT will be sending an e-mail to faculty and staff to remind them of their ongoing responsibility to properly handle PNPI.
“We'd like everyone to re-double their efforts to look again and make sure old files containing Social Security numbers have been deleted, or at the very least, the numbers themselves have been removed from the files,” said Karl Hassler, associate director of IT Network and Systems Services. “We want to continue to impress upon everyone that Social Security numbers, credit card numbers and other PNPI don't belong on personal computers--especially on laptops”, he said, “and that files posted to departmental Web pages must be scoured and cleaned of PNPI. All sensitive personal information should be encrypted while stored. It's an easy step that goes a long way to ensuring that our students' and other's PNPI will be safe, even if on a stolen laptop”.
According to Susan Foster, vice president for Information Technologies, “Vigilance is the key. We've come a long way and don't want to become complacent. We want everyone to double-check that, wherever possible, all Social Security numbers have been removed from user files”.
Remember, information security is everyone's business. IT is available to assist with questions about safe handling of PNPI.
For more information, call the IT Help Center at (302) 831-6000 or visit the computer security Web site at [www.udel.edu/security].
