NASA’s Efforts to Encrypt its Laptop Computers, NASA OIG
“NASA Unlikely to Meet December 21 Encryption Deadline: As a result of the October 31 laptop theft, NASA accelerated the deadline by which all ACES- managed laptop computers were to be equipped with a DAR solution from March 2013 to December 21 , 2012. The Agency estimates that this expedited encryption effort will cost at least $259,000, not including the time civil servants have devoted the project. The Agency also established the same deadline for encrypting non-ACES machines. In our judgment, it is extremely unlikely that the Agency will meet its December goal primarily because the Agency does not have a full account ofthe number of ACES and non-ACES laptops in its possession. Without knowing the full universe of laptops that require encryption, the Agency cannot be sure that all of its laptops are protected with whole-disk encryption software.”
Keith’s note: According to NASA PAO: “NASA takes information technology security very seriously and thanks the Inspector General for its recommendations for further strengthening NASA’s systems. Most recently, NASA has accelerated its commitment to encrypting all agency laptops, encrypting more than 11,000 agency laptops in just the last few weeks. NASA has also implemented new policies and processes that will prevent future losses of personally identifiable information, such as directing that no NASA-issued laptops containing sensitive information can be removed from a NASA facility unless whole disk encryption software is enabled or the sensitive files are individually encrypted.”
DAR Implementation Email from LaRC Center Director Lesa Roe, earlier post
“The Administrator has told all of his direct reports that he expects 100 percent completion by the 21st or it will be reflected in our performance. For clarity, I will do the same with each of you. I think you all know this but I will state it clearly … this isn’t an option … it is mandatory for employment”
– NASA’s One Size Fits All DAR Solution Stumbles, earlier post
– NASA’s Stolen Laptop and Data Problem Just Got Worse, earlier post
– earlier posts
LetMessage from the Chief Information Officer
The Importance of Security During the Holiday Season
Let’s not forgt the timely message from the CIO on “The Importance of Security during the Holiday Season”! It seems the CIO has recently learned that “Online and physical security is vital to the defense and protection of personal and professional assets. As we enjoy the festivities, let us also remember to take simple precautions to protect our homes, our work environment, and our families from those who may wish us harm.”
Too late, Ms. Cureton! Nice of you to close the barn door, but it appears the horse has already vacated the premises. Thanks anyway!
It would have been more to the point to say to employees who take laptops offsite, “You lose it, you pay for it.”
In fact no obvious attempt seems to have been made to correct the actual problem, which was loss of government property. The purpose of DAR was to allow management to say that civil servants could continue to put PII on laptops, take them offsite and lose them, but that this was OK because there would be no embarrassing data released. As for DAR, that $259K is a gross underestimate since it doesn’t include the substantial time users and administrators will have to spend coping with it for as many years as it lasts.
OIG Doubts NASA Can Meet Laptop DAR Deadline: Really? Is that what the OIG is there for? Is that what my tax dollars are going for at the OIG. Predicting failure of a bold initiative. Who on this site, who anywhere could not predict failure? Here is a thought OIG: NASA is the only agency you have saying it is aggressively pursuing this. Why don’t you point out DETAILED CONCRETE RECOMMENDATIONS YOU WILL STAND BEHIND to make it happen and use this as a test bed for getting other agencies to get this done? Smart guys sending our copy while wrapping Christmas presents at their desks annoy me.