| |||
|
|
||
|
|||
| |
|
Home > Security News > Security Blog Log: Was the analyst a VA scapegoat? |
| |
|
|
|
|
| Security News: |
|
||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
That was the verdict of U.S. Department of Veterans Affairs (VA) Inspector General George J. Opfer, who released a scathing report (.pdf) Tuesday on the now-infamous VA data theft. Security bloggers generally agreed, though some wondered if a disproportionate amount of blame had been placed on the analyst's shoulders. Sure, he showed poor judgment by walking out of the office with such a large volume of sensitive information, where it was eventually stolen in a burglary. But, some bloggers asked, wasn't the analyst's lack of security scruples simply a symptom of the larger problem? After all, they said, the data may never have left the office had department supervisors been paying closer attention.
The supervisors deserve most of the blame, as far as Liquidmatrix blog keeper Gattaca is concerned. "I'm still annoyed that the VA was trying to hang the employee out to dry on this issue in a bid to save face," he wrote in a posting this week. "Simply deplorable." He added, "The funny part here is that the sacrificial lamb … had permission to have the laptop with SSNs [Social Security numbers] on it. I'll say it again, he HAD PERMISSION." Tom Fragala, an identity theft victim and founder of Truston Corp., a credit-monitoring and identity-theft recovery service, noted in the Truston blog that the VA inspector general found that the analyst whose laptop was stolen had the OK to access the data, but apparently not to take the laptop home. "I think there will be a different of opinion there," Fragala said. "The analyst (with 34 years at the VA) might argue that since his PC was a laptop, how could he use the data without taking it home?" But when focusing on the analyst, one misses the point, he said: "It was lax security policies and lack of encryption, plus poor response measures that sunk this ship." Of course, the VA has announced measures to strengthen those security policies. But Charles Stricklin wrote in the Homeland Stupidity blog that the latest proposals are too little, too late. "In a case of closing the barn door after the cows have all gotten out, the [VA] took steps to get its information security in order … a half decade after security alerts were first issued and nearly two months after the largest personal data breach in U.S. history," he said, in reference to VA Secretary Jim Nicholson's plans to order a complete restructuring of information security. During congressional hearings last month, Nicholson announced that VA facilities across the country would "stand down" for Security Awareness Week, during which VA managers would be expected to "review information security and reinforce privacy obligations and responsibilities with their staff." In military terms, Stricklin noted, a "stand-down" is "an order given to military units, ranging from a single military command to the entire Department of Defense, to cease all but the most basic of duties and focus all attention and training on the special task given them." Given all the internal security reviews over the years, he expressed doubt that this stand down will do any good. For instance, in 2003, he said, staff members in the VA inspector general's office demonstrated that online outlaws could get access to veterans' protected medical information from outside the VA network. Last year, internal reviews found that access controls were not consistently applied at dozens of data centers, medical centers and regional offices. "Recommendations included ensuring that background checks are performed on VA and contract workers, restricting off-duty workers' access to sensitive information and providing annual security awareness training for employees," Nicholson said. Still, access restrictions and security awareness training didn't stop the VA analyst from taking sensitive data out of the office, resulting in an incident that will long be remembered for its numerous and dumfounding missteps.
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||
|
|||||||||||||||||||||||||||
| |||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||
