
"The server’s security settings were not properly configured and its sensitive data had not been fully protected," Bobby Schnabel, the school’s vice provost for technology, said in the statement.
"Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."
Schnabel told SCMagazine.com that he blamed the event on the fact that the compromised server was overseen by a smaller IT staff "with more general sets of responsibilities" than the university's central IT department.
"Sometimes you don’t get the attention to security you get in a big, central organisation," he said.
IT officials believe the attackers were not trying to purge sensitive information, but instead gain control of the machine for use as a botnet. Had the firewall been enabled, the worm would have been stopped, Schnabel told SC.
Chandler Hall, vice president of marketing and a co-founder of network security firm Arxceo, told SCMagazine.com that the college should have had a network-layered defense to stop both signature-based and zero-day attacks.
"I think bottom line — there’s always going to be a human factor," he said. "I would never point a finger at a large LAN environment and say that it was poor practice."
As a result of the incident, the college is ordering the IT operations at the Arts and Sciences Advising Center to come under the control of the central IT department at the university, Schnabel said.
In addition, the college has instituted a plan to stop using Social Security numbers as identifiers, according to the statement.
Technology-wise, the university plans to implement new host-based intrusion detection HIDS software, which monitors systems for suspicious activity. Last fall, the school deployed a "restrictive network firewall" that has helped cut down on vulnerabilities.
The university also conducts a security awareness program, in addition to conducting regular risk assessments.