And Then There Were None ...

Many universities make the headlines—not for their football teams or academic excellence—but for their security breeches. College campuses are often seen as rich, ripe targets containing the personal information of thousands of students and faculty, successful alumni and wealthy contributors. While there are cases of hackers breaking into central computer systems— a more common (and easier target) are unprotected servers, workstations and laptops.

“It’s as far away as the machine you touch,” says Bob Losee, Systems Coordinator, Enterprise Information Solutions. “What we need to do at UNL is find the points of vulnerability. If someone has an Excel spreadsheet with names and Social Security numbers (SSNs) on their laptop, that information is at risk.”

One of Information Services’ priorities is to inventory and eliminate the use of Social Security numbers wherever possible. “People should ask the question, ‘Do I really need to collect Social Security numbers?’” explains Gary Aerts, Director, Enterprise Information Solutions. Identity Management work efforts have resulted in all students, faculty, and staff being assigned a new identifier—the NU-ID number. NU- IDs can now be used in lieu of SSNs.

Aerts says Information Services is identifying two basic categories: data in motion and data at rest. “Data in motion means data being transferred—for example, the user enters their SSN into a web-based form. Data at rest may be a list of social security numbers stored on a workstation, in someone’s database, even in physical paper files.” IS is asking all departments to inventory where SSNs are used or stored. “Once we identify that,” says Losee, “we can then use a conversion tool so the individual program will use NU- IDs instead.

“It’s important to note,” says Losee, “that SSNs are one component of personal information that needs to be protected—but it’s a very serious part.”

To report where Social Security Numbers are being used or to convert to NU- IDs, use the inventory form. ■