> SACRAMENTO—Educational Testing Service (ETS), a nonprofit assessment organization under contract with the California Department of Education (CDE), has begun notifying California students and families about a data security incident involving unauthorized access to and copying of student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS Notice of Data Breach to help ensure affected individuals receive information about the incident and available resources.
> Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls.
I would like to know exactly why an SFTP site and how it was compromised, and what it means to "build an entirely new SFTP site". For white hat purposes, obviously.
Contractors are often responsible for data breaches, including defense contractors. How do you enforce data security standards in contracts and in practice?
That's above my pay grade to solve, but is obviously needed.
> SACRAMENTO—Educational Testing Service (ETS), a nonprofit assessment organization under contract with the California Department of Education (CDE), has begun notifying California students and families about a data security incident involving unauthorized access to and copying of student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS Notice of Data Breach to help ensure affected individuals receive information about the incident and available resources.
> Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls.
I would like to know exactly why an SFTP site and how it was compromised, and what it means to "build an entirely new SFTP site". For white hat purposes, obviously.
https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp
Breaches like this should be company-ending events.
Contractors are often responsible for data breaches, including defense contractors. How do you enforce data security standards in contracts and in practice?
That's above my pay grade to solve, but is obviously needed.
Agreed. Three years of student data leaked is pretty severe and a major FERPA violation.