NASA OIG on NASA IT Security

Review of NASA’s Computer Security Incident Detection and Handling Capability
“In general, we found that the SOC has improved NASA’s computer security incident handling capability by providing continuous incident detection coverage for all NASA Centers. … However, we also found that the SOC does not currently monitor all of NASA’s computer networks. Even though networks we reviewed had their own incident management program that included network monitoring, dedicated staff to respond to incidents and documented processes the networks’ management programs do not provide the centralized continuous monitoring coverage afforded by the SOC. In addition, NASA needs to increase its readiness to combat sophisticated but increasingly common forms of cyber attack known as Advanced Persistent Threats (APTs).”