Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

VA Posts Data Breach Reports Online

Monthly updates show the different ways data has leaked out of the agency, including lost or stolen hardware and misdirected emails.

Once again showing that it's serious about transparency, the Department of Veterans Affairs (VA) has begun posting reports about data breaches on its website.

The monthly reports, which the agency compiles for Congress, list different ways the VA has lost data, such as through lost hardware or misdirected emails.

For example, a report (PDF) from July 5 to Aug. 1 shows the agency lost two PCs, 13 BlackBerry devices and six laptops. It also reported 103 of so-called "mis-mailed" incidents, and 90 "mis-handling" incidents.

All of the lost laptops were encrypted, according to the report.

In the past the VA has had some major data breaches, including one in April that involved the loss of two unencrypted laptops that contained personal information about more than 600 veterans.

Another infamous data breach in 2006 involved the theft from a VA employee's home of a laptop that contained data on more than 26 million veterans. That incident spurred a Congressional review, as well as cost the agency $20 million to settle a class-action suit.

The VA is taking its data breaches seriously enough that VA CIO Roger Baker has begun monthly calls with members of the press to discuss them.

Since taking his position, Baker has made a concerted effort to improve IT operations at the VA, with data security being a major priority.

The posting of the reports also shows how far the agency has come in terms of transparency and accountability for its IT operations, which historically have been criticized for serious inefficiency.

Baker has put into effect an accountability program that flags IT projects behind schedule, over budget, or both. That program, which was recently expanded to all of the VA's IT projects, saved the agency $54 million in its fiscal-year 2010 budget.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.