Four dozen high-tech computing devices disappeared from the offices of NASA over a two-year span, including one laptop that contained the code needed to command the International Space Station.
No big deal, guys!A laptop with the algorithm used to control the ISS was one of 48 gizmos and gadgets that NASA either reported lost or stolen between April 2009 and April 2011, the agency’s inspector general, Paul Martin, tells the House Committee on Science, Space and Technology. Although the incidents date back to nearly three years ago, Martin has only now informed Congress of the accidents. They are discussed in a written statement he authored and published this week under the title “NASA Cybersecurity: An Examination of the Agency’s Information Security.”For the Cliff Notes version, we’ve got you covered. Information security at NASA: not so good. Over the course of ten pages, Martin makes mention of what he says are five issues that NASA believes, based on their “extensive audit and investigative work,” make up NASA’s “most serious challenges in the admittedly difficult task of protecting the agency’s information.”For starters, we suggest putting a damn lock on the safe.Martin goes on to list those challenges as including a “lack of full awareness of Agency-wide security posture,”“shortcomings in implementing a continuous monitoring approach to IT security” and the “slow pace of encryption.” Also, however, he adds that one “challenge” in particular, is the ability to handle a sophisticated cyber attack. Now, what separates a sophisticated cyber attack from a stupid, simple-minded one is something Martin would have to extrapolate on a bit more. But in regards to losing four dozen mobile computing devices — well, keeping a close eye on those things isn’t rocket science. And if it was, you’d expect NASA of all agencies to be able to handle it, wouldn’t you?According to the congressional testimony, NASA spends around $1.5 billion each year on IT-related activities, which includes approximately $58 million on IT security. And while the statement acknowledges that losing sensitive information could “adversely affect national security,” Martin makes note that lapses have caused concern time and time again. He also admits that security within the agency is not up to snuff, while at the same time revealing that NASA is a “regular target” of such attacks. The 48 missing mobile devices isn’t the biggest number in the report, though. In 2010 and 2011, reveals the report, NASA reported over 5,400 incidents where either malicious software was found on computers or unauthorized users were granted access to the agency’s systems. For the sake of pointing out the significance of how spectacular of a security flaw this is, we will publish this line as a standalone statement:NASA SUFFERS OVER 5,000 SECURITY BREACHES A YEAR ON A SYSTEM THAT IS IN CHARGE OF GIANT, SPACE-SURFING MISSILES.You would only assume that if they can land a man on the moon, surely they could install a copy of McAfee Antivirus.Those problems, adds the report, have indeed caused the disruption of mission operations and is estimated to have costs NASA $7 million in just one years’ time. In their defense, however, the agency has issued 21 audit reports during the last five years, which have spawned 69 IT-related recommendations. Whether or not they followed through with those, however, is anyone’s guess. Regardless, Martin does make note that the agency has identified that there is indeed “weakness” in regardless to its IT security. That, you see, is something you shouldn’t have to admit to. Over the span of just ten pages, the word “weakness” appears four times.One of those weaknesses is indeed the ability to monitor mobile devices that are lost. The damage, reveals the report, has been not just the loss of the code used to command and control the International Space Station (that one-million-pound hunk of machinery that NASA allocated $72.4 billion towards), but also Social Security numbers and other sensitive data. Don’t worry too hard, though. NASA says that eventually they will able to remediate these issues. It’ll take a bit of work though. "Until NASA fully implements an agency-wide data encryption solution, sensitive data on its mobile computing and portable data storage devices will remain at high risk for loss or theft," reads Martin’s report.And if you were wondering, “risk” appears an average of twice-per-page in the report.