Re: Legacy use of partial SSNs as identifiers

["Basgen, Brian" <bbasgen () PIMA EDU>]

 Several years ago we identified all the active students who still had SSNs and we converted them over to student IDs. 
We didn't see a viable way to convert all our archival records, and the risk is fairly low.

~~~~~~~~~~~~~~~~~~
Brian Basgen
Information Security
Pima Community College
Office: 520-206-4873


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Martin 
Manjak
Sent: Tuesday, June 02, 2009 10:17 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Legacy use of partial SSNs as identifiers

Prior to legislation in many states prohibiting the use of SSNs and, and
later, partial SSNs , a lot of schools were using these values to
generate student IDs. While moving away from SSN related values to some
form of unique, random identifier was a significant challenge,
converting the old IDs--and all the records keyed on them-- into the new
formats posed more formidable obstacles.

I'm curious as to whether any institutions still have legacy identifiers
that utilize partial SSNs, and what, if anything, you're considering
doing with them. Presumably, the bulk of those records belong to
individuals who are no longer active students.

Feel free to reply off list if you prefer.

--
Martin Manjak
Information Security Officer
University at Albany
CISSP, GIAC GSEC-G, GCIH, GCWN
518/437-3813
mm376 () albany edu