The fault lies with the contractor that Arapahoe Community College (ACC) hired to manage the student information database.  An employee for the contractor lost a USB drive at the Copper Mountain Resort, and now 15,000 ACC students are being notified of a possible data breach.  Obviously, the incident could have been averted with the use of full disk encryption solutions like AlertBoot.  However, an easier way to prevent the situation from happening in the first place would be not to carry such information around.

I was almost going to note that it’s not a good idea to carry around sensitive information on 15,000 people while on vacation—the loss having happened at a resort—but I’d be assuming the guy was not on assignment.  After all, the hospitality industry is huge when it comes to maintaining databases.  (On the other hand, if the guy was on vacation…why carry such information?  He’s just asking for trouble, especially if such a data device does not feature encryption.)  The sensitive data lost in this case includes names, addresses, credit card numbers, and Social Security numbers, according to this article at 9NEWS.com.

As noted on pogowasright.org, someone from the ACC has an entry in the comment section, stating the credit card numbers and SSNs were included for 5,286 students only.  Plus, the incident affects “non‑credit students in the Corporate Learning Division in Parker.”  The reason why there are “15,000 records were in the database is because it was a compilation of 11 years.”  Most people will probably fixate on the “11 years.”  I’d fixate on “database.”

The implication, of course, is that some guy is totting around an entire database of records in a flash drive.  And not encrypted, to boot.  You may as well say this contractor was hired to mismanage the student information database.  I mean, isn’t information security included under the moniker of database management?

Actually, now that I bring that up—assuming this particular contractor was not practicing the basic aspects of database management—I wonder if there were other databases on that flash drive?  I mean, are there other companies or organizations affected by this particular USB drive loss?  It hardly seems logical that the flash drive had the sensitive records of one client only.  Time will tell whether this turns into a Colt Express scenario.

Related Sites:

http://www.pogowasright.org/article.php?story=20080804160738543

http://www.9news.com/