ks6+Pf&Ô,YnRi$M^~HH  JoE-ǹy&qbw/o~?޼ C1A1uw 92b$C i456ǂ:'rjyO$JZ&aًKlnD#ƹvfvIو',v=%$TNcdgEV5iWtg\8&О1r@Җ y>e3F\  C#B(jW/#8yDG802ê[[fTF o^ӆ[XO0)D䔜J=%$+9õ@h;loj[{f:Z4*gN:®!$Cʴ>6RhM X_Oyާί9ϩ4wGD3щfљEԀTW)e4e\֠Ә}*ӓX[1%v"*DD7k.Ml MLKݷIrǮ,JpP^1bxmGˁF9%n{?Z?86;3zeS֪M<3jB Mp`L%dNw^3 ddZP^<%E`ָ N# Zf\gnM3[KJ_'Ut=QpF gh+cjT:s!7ԞԚUY u+>nU{Z `|`27 uqI"ru"Mqv=C9cX;hc-Pffq P]=8" YS\1*)k>՝_}0t$^YZ1lq#l07N"n5+a8i^& "hUM zVCA+>qOZx,VsW4E IFrD`,POSJ#Xz+6h4om̅Ři8 5(A`jh7?9hDzCCPVA81@Fqk$麮5Gff^t:^BЊº(ƃs^"X`37MZ 3<2!nc *6GLkW,sC{Y2`: R10S"ӸSmXm!u5u=7 1@1}RS :޺CL惇?܄U?hnŀ\`E,Vwǵ>h?>3º_]B|NWyiZsw@EUPQM~]8.\:K̍pXl` ~ 47,HJ- .qe3- #4[Is0FW9jY2#̺PlQG A0@;9l7 KBBN@n?+,56f?+"w^ټoPK$w!8CoL'1^f$оn67ءUasb !eܘ쥫3}sZn`ChЪ6:*YR)uߔy2:&f&9+*uJHjƓ}XNjL8_ȘRu@cޑ7/^*~q 8l,=*֞߻ß~"pw>(A?ݣaFLK*?Ow 1$mj $jl׏V~`"WqlUfa_y5O]κ.ƾqg1F3r{ iٞ0OaU fZOsKU٧ 5QK4cb ffTtirrk%6Lss}wߕ)vHlN1f3<6"bSyr͜p"e:MFLL3yC15Z9,vo[q)mԨS ,xd4YR,ݫmF>;S]&apV+2KHq&y6]y @eQ9J?:;b}3ĭY!g\OTeCO*%qA2d#dp 5w|˷ĞUbI(L]{.Rɏ7'G7O>׼FjSvON`R$H'/z[H9 ,oFcSc>f,ɬ{ah/rnh?n4O==l>i*=$c'rR~HաjU0 єz \ܩ &@@q!?O5/G3(\۝UiZ|Wm^ި5P[< +yc"=C'\:E.|`*Mz1´h&b ̛\ 11/07/06, One Step Ahead - Almanac, Vol. 53, No. 11
Print This Issue

One Step Ahead: Privacy and Security Tips
November 7, 2006, Volume 53, No. 11

One Step Ahead

Another tip in a series provided by the Offices of Information Systems & Computing and Audit, Compliance & Privacy.

Carelessness with Consequences

Don’t let this happen to you; it could. Dave, a business administrator, discovered that dozens of his department’s employees’ salaries, SSNs, and performance appraisal ratings were publicly available on the Internet.

Dave was computer savvy and had been given responsibility for the department’s web accessible database. Though not an expert, he thought he knew enough to get the job done. However, in today’s complex web environment, he didn’t know enough about how to protect data. Thinking a database set up on a widely used database application would be accessible only to three of his colleagues, he was shocked to find some of the data accessible by Internet-based search engines. He assumed a hacker had stolen the data. 

In fact, no one had broken into the computer. Rather, while setting up the database, Dave had accidentally placed the private file in a public folder, available to anyone on the Internet. The entire file was indexed by two of the major search engines.

Two critical lessons can be learned from this situation:

• If you aren't knowledgeable about security-related practices and techniques in building web-based databases, then ask for help from your local computing support provider or consult with ISC Security (security@isc.upenn.edu).

• Do NOT store Social Security Numbers unless there is no alternative. Use the PennID instead. If you wish to convert your SSNs to PennIDs, please contact Vicki Fullam in ISC's Data Administration Group at (215) 746-6376 to get information about a new tool scheduled for pilot testing in December.

For additional tips, see the One Step Ahead link on the Information Security website: www.upenn.edu/computing/security/.

Almanac - November 7, 2006, Volume 53, No. 11