Stolen NASA Laptop Had Unencrypted Employee Data

  /     /     /  
Publicated : 22/11/2024   Category : security


Stolen NASA Laptop Had Unencrypted Employee Data


Data breach drives NASA to now require that at minimum, all sensitive files stored on laptops be encrypted.



NASA is warning all employees and contractors that their personal information may have been compromised after a thief stole a NASA laptop and documents from an agency employees locked car.
On October 31, 2012, a NASA laptop and official NASA documents issued to a headquarters employee were stolen from the employees locked vehicle. The laptop contained records of sensitive personally identifiable information (PII) for a large number of NASA employees, contractors and others, said Richard J. Keegan Jr., associate deputy administrator of NASA, in a
notice sent to all employees
.
The data on the laptop wasnt encrypted. Although the laptop was password protected, it did not have whole disk encryption software, which means the information on the laptop could be accessible to unauthorized individuals, he said.
NASA
doesnt yet know the full extent of the breach, presumably because the agency is still attempting to reconstruct and study everything that was on the stolen laptop. Because of the amount of information that must be reviewed and validated electronically and manually, it may take up to 60 days for all individuals impacted by this breach to be identified and contacted, said Keegan.
[ Avoid a fall from grace. Read
Petraeus Fallout: 5 Gmail Security Facts
. ]
In addition to now implementing
full-disk encryption software
for NASA laptops, Keegan said NASA will pay ID Experts to notify people whove been affected by the breach, and to provide identity theft and credit monitoring services. Anyone affected will be notified about the breach via a written, mailed letter -- but not by email or phone, he said.
Given the
continuing increase
in the number of data breaches affecting organizations, and the accompanying costs of notifying affected people and
cleaning up the mess
, surely technology-savvy NASA would have already required that all agency laptops be secured using full-disk encryption software?
In fact, that hasnt been the case, apparently owing to user resistance. An IT executive at Goddard Space Flight Center, for example, said that the facility recently implemented data-at-rest encryption on PCs. But some users arent fans of the software, which they said interfered with some of the tools on their PCs.
In the wake of this breach, however, NASA administrator Charles F. Bolden Jr. and CIO Linda Cureton have ordered that no NASA-issued laptops containing sensitive information can be removed from a NASA facility unless whole disk encryption software is enabled or the sensitive files are individually encrypted, said Keegan. This applies to laptops containing PII, international traffic in arms regulations (ITAR) and export administration regulations (EAR) data, procurement and human resources information, and other sensitive but unclassified (SBU) data.
NASA facility CIOs have been ordered to add or enable encryption capabilities for the maximum number of laptops by November 21, 2012. By December 21, 2012, all laptops that leave NASA facilities must have encryption capabilities. In the meantime, employees who are telecommunicating or traveling should use loaner laptops if their NASA-issued laptop contains unencrypted sensitive information, according to Keegans communication.
Curetons office will also review whether any further agency security policies need to be revised to help prevent
future data breaches
stemming from lost or stolen laptops.
A NASA spokeswoman didnt immediately respond to an emailed request for comment about what type of full-disk or file encryption technology the agency would be using, whether it planned to train all employees to determine what qualifies as sensitive information that must be encrypted -- or whether employees compliance with the new policies would be monitored and enforced.

Last News

▸ ArcSight prepares for future at user conference post HP acquisition. ◂
Discovered: 07/01/2025
Category: security

▸ Samsung Epic 4G: First To Use Media Hub ◂
Discovered: 07/01/2025
Category: security

▸ Many third-party software fails security tests ◂
Discovered: 07/01/2025
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Stolen NASA Laptop Had Unencrypted Employee Data