Quick Facts

• Date: 6/21/2008
• Institution: Arizona State University, Northern Arizona University, University of Arizona
• Type of Incident: Unauthorized Disclosure
• Number Affected: 10,000
• Source: ESI
• Abstract Source: The Arizona Republic

Abstract
A recent state audit has uncovered a number of serious weaknesses in the web systems at Arizona state's universities. State auditors were able to access personal information, including names and Social Security numbers, of 10,000 individuals. In addition, auditors found weaknesses that, if exploited, would allow an individual to take over large numbers of user accounts, change records and install malicious software. The audit only looked at a small percentage of web applications at the universities and the auditors believe that similar vulnerabilities are likely to exist in other web-based applications at the universities. The audit recommends that Arizona State University, Northern Arizona University and the University of Arizona develop comprehensive information security programs, provide better training for Web developers and conduct regular security tests.