U.S. Navy develops acceptable-use policy for IT equipment
18
The standardized policies are to go into effect in the first quarter of 2005 and will apply to the Navy's 900,000 military, contractor and civilian users.
646904
Defense department contractor initiates partial rollout to show other companies how it's done.
655447
Its new software lets PC administrators create policy controls specifying how long a user will have access to the operating system and applications, what peripherals can connect to the environment, and more.
221657
Device uses NCQ technology to prioritize a PC's requests.
370648
Information technology company Electronic Data Systems Corp. on Friday said it reached a modified agreement for a Navy Marine Corps intranet contract, effective immediately.
766703
(InfoWorld) - A government audit of four U.S. Department of Veterans Affairs (VA) centers found $6.4 million worth of missing or misplaced IT equipment, according to a report released Tuesday. Inventories in fiscal years 2005 and 2006 found about 2,400 missing IT devices at the four VA locations, the U.S. Government Accountability Office (GAO) report said. Among the missing items were dozens of computers that could have stored personal information. The GAO also found computer hard drives being disposed containing the names, Social Security numbers, or medical histories of hundreds of U.S. military veterans. About 28 percent of the IT equipment at the VA medical center in Washington, D.C., was missing or misplaced, the GAO said. The missing equipment in the new GAO report is in addition to an earlier audit showing more than 8,600 missing IT items, with a combined original cost of $13.2 million, from five other VA centers, the GAO said. There is an "overall lack of accountability" for IT equipment at the VA locations, said McCoy Williams, director of financial management and assurance at GAO. The GAO found a "pervasive" lack of personal accountability at all four locations, he told the U.S. House of Representatives Veterans Affairs Committee's Subcommittee on Oversight and Investigations. "Missing IT items were not reported for several months and, in some cases, for several years," Williams told the subcommittee. In some cases, hard drives scheduled to be disposed of sat around for several years without being wiped clean, "creating an unnecessary risk that sensitive personal and medical information could be compromised," Williams added. The VA's IT practices have been the target of frequent criticism by U.S. lawmakers in recent years. The agency, in May 2006, reported that a laptop and hard drive containing the personal records of 26.5 million military veterans and family members was stolen from an employee's home. Police later recovered the equipment, and the VA said the records did not appear to be compromised. Subcommittee members called on the VA to improve its inventory management. "We know that VA has serious problems keeping track of its IT inventory," said Rep. Harry Mitchell, subcommittee chairman and Arizona Democrat. "This is not just a dollar issue. It is also a security and privacy issue." The VA is implementing new IT equipment management procedures and, after a three-month process, has found about 90 percent of the missing equipment, said Robert Howard, the VA's assistant secretary for information and technology. "The lack of accountability was clearly evident," said Howard, who became the agency's CIO in September 2006. "You shouldn't have to go through that to find your equipment." The VA has issued a new equipment handbook, and employees now have to sign for equipment in their control, Howard said. The VA has concurred on all 12 GAO recommendations for inventory management, VA officials said. The VA is also deploying network monitoring software that can scan for devices, Howard said. "This is a critically important issue," Howard said. "This is a situation of utmost importance. It is a situation we are working hard to remedy."
499645
The dress code for the U.S. Navy has gotten a little update to bring it into the 21st century.
419344
The U.S. ITC gives Broadcom relief for patent violation.
637012
A tank is more than a tank -- it's also onboard replacement parts, shovels, computer systems and hundreds of other parts. That's true of any kind of equipment an Army unit uses in overseas deployment.
356771
While corporations are monitoring ports and using advanced security tools to fend off infection and attack, home users -- who have less technical sophistication -- are left more susceptible, sometimes
687490
New deal aims to simplify and protect Air Force networks by introducing standard configurations.
394262
Military research and industrial design bring power-saving PDA to troops in the field.
698751
High-tech companies are working with the U.S. government to develop a secure data-sharing system.
314807
FREMONT, Calif., May 29  /PRNewswire/ -- In response to both the growing threat of cyber attacks and related government mandates in key industries, GarrettCom(TM), Inc., has launched an initiative to provide and promote best practices for industrial network security.
62879
The U.S. and Japanese navies have worked out common rules for their advanced warships designed to shoot down enemy ballistic missiles, the U.S. Navy's Pacific Fleet said on Friday ahead of a milestone test.
700845
HP (NYSE:HPQ) (Nasdaq:HPQ) has been awarded a multiyear contract by the U.S. Army to provide desktop PCs, notebook PCs, printers, scanners and displays as part of a U.S. government requirement to ensure the operational readiness of the U.S. armed services worldwide.
644368
New cybersecurity standards proposed by the North American Electric Reliability Corp. (NERC) to protect the nation's power infrastructure are not broad enough and fail to cover a significant number of interdependent assets.The standards also give electric utility owners, operators and users too much discretion when it comes to implementing the prescribed controls, a group of experts told members of the House Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology on Wednesday.James Langevin (D-R.I.), chairman of the committee, said the NERC's proposed standards require stakeholders in the power grid to establish plans, protocols, and controls for safeguarding physical and electronic access to the control systems that manage the national's electric infrastructure.The problem is the standards are focused purely on the reliability of "bulk power systems" and don't require electric sector owners and operators to secure their generation systems, distribution systems, or telecommunication equipment, Langevin said in prepared testimony."We know from countless real-world examples that these units are highly vulnerable to intentional and unintentional cyber-events. Knocking any of these units off could affect the power supply to our nation's critical infrastructure," he noted in his statement.The narrow focus of NERC's proposed cybersecurity standards is especially troubling, Langevin said, in light of a recent simulated attack against a power utility control system that was carried out by Department of Homeland Security researchers at the Idaho National Laboratory. The same methods that were used in that experiment could be used to carry out attacks against larger generators and other equipment and cause "widespread and long-term damage to the electric infrastructure," he warned."I'll be blunt: If this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty," Langevin said.Joseph Weiss, managing partner of Applied Control Solutions, testified as an expert at the hearing. He said the growing interconnectedness of control systems with other networked computing systems is happening without a corresponding appreciation for the security risks resulting from such connectivity.For the most part, he stated in written testimony submitted to the committee, security issues have been the purview of the IT organizations within utility companies, whose control system groups manage grid and plant operations. As a result, it's often the case that some parts of the system are sensitized to security while others do not fully appreciate the risks, he said.Exacerbating this issue is the fact that many control system applications run in Windows and Unix environments and are therefore susceptible to the same security threats as other systems are. Traditional IT security controls, Weiss said, can help alleviate some of these issues, but they can also cause control system reliability problems.Against this backdrop, he said in his prepared remarks, the NERC's proposed standards are too narrowly focused on bulk power grid reliability, and not, for instance, on smaller substations that might support a major oil or gas pipeline in a remote locale. Similarly, there's not much priority given to securing the continuity of electricity to facilities such as municipal waterworks, manufacturing plants, refineries, hospitals and military installations.Experience has already shown the significant impact that an attack or a security incident against a control system can have on the electricity infrastructure, said Gregory Wilshusen, director of information security issues at the Government Accountability Office. Wilshusen provided written testimony to the committee.As examples, he cited a 2006 incident in which a foreign hacker planted malicious software capable of affecting a water treatment plant's operations, and another incident in which excessive traffic in a nuclear power plant's control system caused two circulation pumps to fail -- forcing the unit to be shut down manually.David Whiteley, executive vice president of the NERC, said that the security issues raised by the interconnectedness of the electric infrastructure and other infrastructures are important and need to be addressed. However, under its existing mandate, the NERC has the authority and responsibility for enforcing reliability standards on only the bulk power grid, not on the distribution system. Developing and enforcing standards on connected infrastructures is beyond the capability of a single body, he said.Whiteley said that in July of this year, the NERC sought comments from the Federal Energy Regulatory Commission on a proposal for approving eight CIP reliability standards. Those cybersecurity standards have been in development for several years and were developed with extensive input from industry experts.Computerworld is an InfoWorld affiliate