Personal details of hundreds of education professionals, such as teachers and governors have been available to view on a public portion of the National Grid for Learning's Web site.

Surfers who register on the site are assured that their information is being held by the NGFL for the NGFL, and will not be passed on to a third party. But it is available to any third party out there who knows about the following vulnerability on Security Focus.

The NGFL Web site runs on a Netscape Enterprise Server 3.6. This version has a directory indexing feature which allows remote users to view the directory by appending various tags to the URL. The software is shipped with the feature enabled by default, and since it is not well-publicised, it is not often switched off.

This problem is easily fixed, all that needs to be done is the feature needs to be turned off in the Administration Interface. More details can be found here.

However, in this particular instance it is not the lapsed security that is the issue. More it is an ongoing struggle to get people security literate. If information is being stored online, it must be made secure.

Leaving software on the default installation settings is akin to buying a safe and not changing the combination on the lock from the factory settings. Once one cracker knows the settings for one site, s/he knows it for all the sites hosted using that application. And in all likelihood, all her/his friends also know the details.

We asked the Department for Education and Employment for a comment, but no-one could be reached by the time of writing. We did however email them the link in the story to Security Focus' site, so that they could fix the hole. ®