Re: P2P sensitive data searches

["Basgen, Brian" <bbasgen () PIMA EDU>]

Hi Corbett,
 
 Is your P2P inspection on your local resnets, and/or academic or
administrative networks? I'm not clear on whether or not the information
you found is institutional data, or if it is data being leaked from a
student's personal computer, for example. If you are checking resnets,
I'm guessing your objective is bigger than just institutional data, and
also includes the general intent to protect students? 
 

~~~~~~~~~~~~~~~~~~
Brian Basgen
Information Security
Pima Community College




 


________________________________

        From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Consolvo, Corbett D
        Sent: Thursday, April 24, 2008 7:17 AM
        To: SECURITY () LISTSERV EDUCAUSE EDU
        Subject: [SECURITY] P2P sensitive data searches
        
        

        Scenario:

          We have begun doing investigation in to whether any sensitive
data from our institution (Texas State University) is showing up on P2P
networks.  We are doing this right now through keyword searches.

         

        Issue:

          We are coming across sensitive/confidential personal
information (SSN, Drivers License, etc.).  While a lot of this seems to
be fake (perhaps a honeypot situation), a small amount of legitimate
information looks to be accidentally shared.

         

        I feel that we have an ethical obligation to at least make an
attempt to either pass the information to an appropriate agency or
contact the individual.  Does anyone have any suggestions or thoughts
about the path to take as well as any possible issues with pursuing
this?

         

        Thanks for any input,

        Corbett Consolvo

        Texas State University

        Cc72 () txstate edu