Rendered at 07:17:44 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
k310 1 days ago [-]
> SACRAMENTO—Educational Testing Service (ETS), a nonprofit assessment organization under contract with the California Department of Education (CDE), has begun notifying California students and families about a data security incident involving unauthorized access to and copying of student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS Notice of Data Breach to help ensure affected individuals receive information about the incident and available resources.
> Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls.
I would like to know exactly why an SFTP site and how it was compromised, and what it means to "build an entirely new SFTP site". For white hat purposes, obviously.
Breaches like this should be company-ending events.
k310 1 days ago [-]
Contractors are often responsible for data breaches, including defense contractors. How do you enforce data security standards in contracts and in practice?
That's above my pay grade to solve, but is obviously needed.
upboundspiral 15 hours ago [-]
You simply engineer your services to not need contractors...
Would it take a ton of capital, intellectual, and cultural investment over the long term? Sure.
But that's the price you pay for security.
agiacalone 1 days ago [-]
Agreed. Three years of student data leaked is pretty severe and a major FERPA violation.
> Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls.
I would like to know exactly why an SFTP site and how it was compromised, and what it means to "build an entirely new SFTP site". For white hat purposes, obviously.
https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp
That's above my pay grade to solve, but is obviously needed.
But that's the price you pay for security.