It is a shame that Carleton University has opted to shoot the messenger rather than lift themselves out of their state of denial and take seriously responsibility for the private information of their student clients. The next person to hack them may not have such good intentions.

While this is a common response in business and enterprise due to executives who only give lip service to this responsibility, it is exaggerated in educational institutions with the common excuse that "we need to have an open environment" which really is code-speak for "we don't want to spend any money". I don't think that having an open environment should mean allowing easy access to private and sensitive data.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35164#35164