California Student Data Leaked

reuters.com

12 points·agiacalone··5 comments

> SACRAMENTO—Educational Testing Service (ETS), a nonprofit assessment organization under contract with the California Department of Education (CDE), has begun notifying California students and families about a data security incident involving unauthorized access to and copying of student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS Notice of Data Breach to help ensure affected individuals receive information about the incident and available resources.

> Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls.

I would like to know exactly why an SFTP site and how it was compromised, and what it means to "build an entirely new SFTP site". For white hat purposes, obviously.

https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp

Breaches like this should be company-ending events.

Contractors are often responsible for data breaches, including defense contractors. How do you enforce data security standards in contracts and in practice?

That's above my pay grade to solve, but is obviously needed.

You simply engineer your services to not need contractors... Would it take a ton of capital, intellectual, and cultural investment over the long term? Sure.

But that's the price you pay for security.

Agreed. Three years of student data leaked is pretty severe and a major FERPA violation.

Reply on news.ycombinator.com