Recently an incident of massive security breach happened in London area school board.  Two senior education officials said that many lessons can be learned from this breach that exposed 27,000 student passwords on the Internet.

How Did Security Breach Take Place

One of the senior officials Bill Tucker, who is education director at the Thames Valley District School Board, his website was hacked in the October attack. As a free press investigation published on Saturday revealed that it took the school board more than 12 hours to call police about the breach, the board’s top official defended its response.

Tucker said on Sunday that,”I’m absolutely comfortable with the way senior administration responded to the breach, we found out late in the afternoon (Oct. 20), the student portal (on the board’s website) was shut down, police found out the next morning and at no time was student safety at risk”.
“Any e-mails going around were copied to me and I insisted on face-to-face meetings (with administrators handling the breach) because the situation was so serious”. He said, “It’s been a learning experience for the board, as a school board, we’ve learned many lessons”. For instance, when we are looking at the encryption of new codes, we need to get on top of it a lot faster, in terms of adapting to new technology.

Obtained emails show that while administrators knew before 9:30 p.m. on 20th Oct. that the board’s website had been hacked and that passwords for more than 27,000 high school students had been posted on facebook hours earlier, the board was not alerted the police until 9:30 a.m. the next day.

Security Risks of Breach

There were immediate security risks because many high school students use their passwords for other purposes, like banking and other online accounts. But that’s not how some Thames trustees sees it.

Officials Defending Response:

New board chairperson Tracy Grant wrote in an e-mail response through facebook that “our administration did react swiftly to the breach, immediately shutting down the portal and ensuring the security of the system, most people are aware that they should personally guard their passwords and not use the same password for different applications – I think our students are particularly aware of the importance of changing and protecting their passwords”.

Grant did not respond to a request for clarification or provide a contact phone number but pointed out London police began a so called Code 3 response to the situation, “indicating it was not of highest priority”.

Arlene Morell, a parent who heads the board’s parent involvement committee, said that the primary concern should always be the safety and protection of all students. “And I believe it was, freezing, shutting down and whatever they can do internally to ensure the protection of students was safeguarded,” she said.

Data breach is the unintentional release of secure information to an untrusted environment so the protection of data (information security) is very important.

How Alertsec Xpress Would Have Helped:

In an incident which highlights the need of a data security and recovery software, the threat could have simply be reduced to an insurance matter by a mere investment of $13/month. The information would have been secure with no loss what so ever. That is certainly a small price to pay compared to what can happen if you lose confidential or sensitive data.  Alertsec Xpress offers a very good and easy-to-use laptop security service that includes more than the traditional software licensing model. Feel free to subscribe for your personal 30-day free trial.

Related articles

• School board to upgrade security after 27,000 student passwords hacked (theglobeandmail.com)
• Teen charged after 27,000 student passwords posted (thestar.com)