Almost a year later, it seems that the University of California Berkeley has been breached yet again. In September of 2014 the school’s Real Estate division was the victim of a digital interloper who compromised their systems. But, I was hopeful that they would have taken steps to ensure that this sort of thing would not happen again.
Now, we find the school in cyber security trouble again as some 80,000 students and staff had their information as the result of a breach of their systems.
The university said among the potentially affected are 57,000 current and former students; about 18,800 former and current employees; and 10,300 vendors who work with the school. Those figures come out to about half of the school's current students and two-thirds of its active employees.
The attackers breached the systems in December 2015. Yet again the school finds itself paying out for credit protection services and having to hire forensic computer investigation services. Now, I understand that breaches happen. Sadly, most defenders have the problem of playing an eternal game of keep away with attackers. Adversaries that don’t operate with the typical constraints of a business or especially those of a university.
The part that struck me this time was that the attackers were able to gain access “due to a security flaw present when the system is updating.” Now, why would these systems be online and accessible during an upgrade? To put a fine point on it, this was their financial management software. The din of confusion here is simply deafening.
"The security and privacy of the personal information provided to the university is of great importance to us," Paul Rivers, UC Berkeley's chief information security officer, said in a statement. "We regret that this occurred and have taken additional measures to better safeguard that information."
Hey, that’s great. But, what of the steps that were taken last time there was a breach at the school? Why are we back here again a year later dealing with another data breach? Having suffered through a data breach or two in my day, I can empathize with the defenders. As I’m certain most of my readers have had to endure at some point or another in their career. There is nothing fun about it. But, to have a repeat performance after a breach a year earlier is confusing to me.
I don’t want to seem like I’m repeatedly kicking a dead horse to the point where it has been reduced to a fine paste or jelly. We need to learn from our mistakes. And mistakes will happen. It is OK to fail so long as we are able to learn from those failures.
Recently, I was told that I need to take more risks. The person telling me said that he had not seen me fail. I laughed uproariously at this notion. I fail all the time. One of the joys of being human is that we make mistakes. The difference in my case is that I choose to use my missteps as learning opportunities rather than to whinge about them.
It is OK to fail. Just don’t continue to fail the same way.