Risk
8/13/2010
03:56 PM
50%
50%

VA Posts Data Breach Reports Online

Monthly updates show the different ways data has leaked out of the agency, including lost or stolen hardware and misdirected emails.

Once again showing that it's serious about transparency, the Department of Veterans Affairs (VA) has begun posting reports about data breaches on its website.

The monthly reports, which the agency compiles for Congress, list different ways the VA has lost data, such as through lost hardware or misdirected emails.

For example, a report (PDF) from July 5 to Aug. 1 shows the agency lost two PCs, 13 BlackBerry devices and six laptops. It also reported 103 of so-called "mis-mailed" incidents, and 90 "mis-handling" incidents.

All of the lost laptops were encrypted, according to the report.

In the past the VA has had some major data breaches, including one in April that involved the loss of two unencrypted laptops that contained personal information about more than 600 veterans.

Another infamous data breach in 2006 involved the theft from a VA employee's home of a laptop that contained data on more than 26 million veterans. That incident spurred a Congressional review, as well as cost the agency $20 million to settle a class-action suit.

The VA is taking its data breaches seriously enough that VA CIO Roger Baker has begun monthly calls with members of the press to discuss them.

Since taking his position, Baker has made a concerted effort to improve IT operations at the VA, with data security being a major priority.

The posting of the reports also shows how far the agency has come in terms of transparency and accountability for its IT operations, which historically have been criticized for serious inefficiency.

Baker has put into effect an accountability program that flags IT projects behind schedule, over budget, or both. That program, which was recently expanded to all of the VA's IT projects, saved the agency $54 million in its fiscal-year 2010 budget.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?