Cybersecurity group questions VA legislation
683732
(InfoWorld) - The cybersecurity provisions in a U.S. Department of Veterans Affairs (VA) bill approved by Congress late last week are in some ways too narrow and in others too broad, a cybersecurity group says. The Veterans Benefits, Health Care, and Information Technology Act, largely focused on veterans' health-care programs, includes a section on information security requiring the VA to report data breaches of any "sensitive" personal information, potentially including breaches where only veterans' names were exposed, said Liz Gasster, general counsel for the Cyber Security Industry Alliance (CSIA), a trade group representing cybersecurity vendors. The bill, passed by Congress late last week, requires the VA to report breaches of sensitive personal information to Congress and requires VA Secretary R. James Nicholson to create plans for notifying affected veterans, as well as offering credit monitoring and identity theft insurance to affected veterans. If the VA ends up notifying veterans every time a document with just names on it is lost, veterans may become numb to breach notifications that contain real dangers, Gasster said. Thirty-four enacted state data breach notification bills require that a name be coupled with other data, such as an unencrypted Social Security number, drivers' license number or financial account number. "Essentially, the loss of a list of names on a piece of paper constitutes a data breach under the law, which seems far too broad," she said. "Clearly, your name is not sensitive personal information." The VA announced in mid-May that a laptop and hard drive containing the personal information of 26.5 million military veterans and their spousesÂ had been stolen from an employee's home about two weeks earlier. Police later recovered the hardware, and VA officials said the personal information had not been compromised, but the breach set off a firestorm of criticism from Congress. In addition to its potentially broad definition of sensitive personal data, the bill does not exempt the VA from reporting data breaches if the information was encrypted, Gasster said. In supporting a national data breach notification bill, CSIA and other groups have called on Congress to exempt encrypted data from notification rules, saying the exemption would encourage companies and government agencies to encrypt more data. The lack of an exemption "seems like it deprives the benefit of encryption from the VA," Gasster said. Although the bill's language on personal sensitive information and encrypted data is too broad, in some ways the bill doesn't do enough to protect consumers, Gasster added. The bill only addresses VA data breaches, not breaches at other government agencies or private companies. CSIA and some consumer groups have pushed for a national data breach notification bill after a rash of breaches in early 2005, but Congress failed to pass a notification law. While the VA's large breach generated significant attention from Congress, other agencies have lost dozens of laptops containing personal information in recent years, and private businesses continue to have breaches, Gasster said. CSIA wants a bill that would require agencies and companies to take reasonable security measures to protect data, Gasster added. A spokesman for Senator Larry Craig, the Idaho Republican who sponsored the veterans bill, didn't return messages seeking comment on the CSIA's concerns.
588133
Subcommittee hears objections to, support for 411 wireless directory legislation.
512188
WASHINGTON -- The Department of Veterans Affairs says a computer hard drive missing in Alabama since last month was not encrypted, the latest in an embarrassing series of data breaches sparking concern in Congress.
114729
Members of the Second Life online world criticise the handling of a serious security breach.
434975
The Veterans Administration and its benefits programs need to be streamlined, a Congressional panel was told.
416606
(InfoWorld) - Fixing cybersecurity problems in the U.S. is a top priority at the U.S. Department of Homeland Security, said the agency's leader, but lawmakers didn't focus on the issue during a hearing in Congress Wednesday. Cybersecurity is a "very big issue" that DHS remains concerned about, said DHS Secretary Michael Chertoff, testifying before the House of Representatives Homeland Security Committee. Chertoff didn't go into details because much of the department's cybersecurity efforts are classified, he said. "I can assure you that we are working with other elements of the federal government and giving highest priority an enhanced strategy with respect to cybersecurity," he said. Cybersecurity threats have "enormous potential to do damage to the United States in years to come," Chertoff added. Chertoff testified before the committee in a hearing titled, "Holding the Department of Homeland Security Accountable for Security Gaps." But while cybersecurity problems continue inside and outside of the U.S. government, lawmakers focused on other issues during the hearing, including the hiring of border agents, training of bomb-sniffer dogs, and the scanning of airline cargo. Just this week, the U.S. Department of Defense acknowledged a successful attack on an unclassified e-mail system earlier this year. While not focusing on cybersecurity, committee chairman Bennie Thompson, a Mississippi Democrat, said DHS needs to improve in several areas. Thompson has criticized the department's cybersecurity efforts in the past, but cybersecurity issues were not on Thompson's list of top priorities for Chertoff in the remaining 16 months of U.S. President George Bush's administration. Instead, Thompson called on Chertoff to fill vacancies at DHS, to finish regulations for container security at ports, and to implement a biometric air passenger screening program. "We owe the American people security," Thompson said. "We owe them accountability. And most importantly, we owe them freedom from fear." Other than the short Chertoff statement on cybersecurity, the issue did not come up again in more than 90 minutes of questions from lawmakers. Representative Mike Rogers, an Alabama Republican, used part of his question time to complain to Chertoff that many bomb-sniffing dogs used by DHS came from overseas. Rogers urged Chertoff to find ways to breed bomb-sniffing and cadaver dogs in the U.S. "I'm concerned that we are increasingly relying on foreign imported dogs," he said.
628329
At a packed Beacon Hill hearing yesterday, top officials from Verizon Communications Inc. faced skeptical questions about a telecommunications bill yesterday from a legislative committee and a crowd that hissed and heckled at times.
684167
When a Department of Veterans Affairs laptop computer was stolen in May, putting the sensitive personal information of millions of veterans at risk, VA officials sought to quell concerns by providing a toll-free number to call.
100547
Fixing cybersecurity problems in the U.S. is a top priority at the U.S. Department of Homeland Security, said the agency's leader, but lawmakers didn't focus on the issue during a hearing in Congress Wednesday.
766424
The U.S. Congress needs to pass healthcare IT legislation before private companies develop multiple systems that don&#39;t talk to each other, two advocacy groups said Tuesday.
575194
(InfoWorld) - The U.S. Department of Veterans Affairs has made some progress since aÂ May 2006 data breach, but it has not completed 20 of 22 recommendations from an internal auditor, according to a report released Wednesday. As of May, the VA had not yet addressed several "critical success factors" for transforming its IT management, the U.S. Government Accountability Office said in its report. The VA had only completed two of 22 recommendations from its inspector general following the breach, in which a laptop and hard drive containing personal records of 26.5 million veterans and family members were stolen from a VA employee's home. The VA also needs to improve its IT asset control, the GAO said, referencing a July report showing about 2,400 missing IT devices at four VA locations in 2005 and 2006. While the VA has "many significant initiatives under way," problems persist even in the programs meant to fix past problems, the GAO report said. "We continue to see management weaknesses in these programs and initiatives, which are the very weaknesses that VA aims to alleviate," the GAO report said. The VA has not completed a comprehensive security management program recommended by the GAO, and it has not strengthened its critical infrastructure planning process, which was recommended by its inspector general, the GAO said. In addition, the VA has worked with the U.S. Department of Defense for 10 years to share electronic medical records, but the two agencies are "far" from completing that work, the GAO said. Robert Howard, the VA's assistant secretary for information and technology since last September, largely agreed with the GAO report while testifying before the U.S. Senate Veterans Affairs Committee Wednesday. "Since the May 2006 data breach, the VA staff is now more aware of the importance of protecting our veterans' and employees' information and identities," Howard said. "While we do have a way to go here, I have definitely seen improvement." The VA has encrypted more than 18,000 laptops since the breach, and it is rolling out software that blocks unauthorized data storage devices, such as thumb drives, from connecting to the VA's network, he said. The agency has also installed software that blocks VA employees from sending e-mail containing Social Security numbers, he said. As the VA was rolling out the e-mail filtering software, the software caught about 7,000 e-mails containing Social Security numbers in just one month, Howard said. The VA is also in the process of centralizing its long-criticized location-based IT structure, and the agency's goal is to compete the realignment by July, Howard said. Senator Daniel Akaka, a Hawaii Democrat and committee chairman, noted that VA Secretary of Veterans Affairs Jim Nicholson promised the agency would become a "gold standard" for cybersecurity following the 2006 breach. "How close is VA to becoming the government leader in information security?" Akaka said. Howard recounted some of the agency's progress, but said there's still work to do. "I don't know, to be honest with you," he said. "We hope to be very close by the end of this fiscal year." Howard also talked about seven major priorities, including a "well-led, high-performing IT organization." Senator Richard Burr, a North Carolina Republican, asked Howard to rate each priority on a scale from one to 10, with 10 meaning fully completed. Howard's progress ratings on some of the priorities: *Â Standardizing its IT infrastructure and business processes: 3 *Â Establishing programs to make the agency's IT system more : 2 or 3 *Â Remedying the agency's "long-standing IT material weaknesses" relating to a lack of security controls: 5 "All this will take some time to put in place," he said.
634583
The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union are among groups promoting opposition to bills that would create an NSA-run electronic surveillance program.
632307
Group says popular technique threatens U.S. security by sidelining other approaches more suited to decryption and the like.
267145
A cybersecurity group yesterday called on US President George Bush to invest more in IT issues and to make the top IT security job a bigger posting.
690068
Lawmakers grill U.S. Department of Homeland Security CIO after an audit found that a vital database lacks security controls.
277157
A group representing technology industry executives yesterday called on the Bush administration to step up efforts to protect the nation&#39;s computer and Internet infrastructure, and it proposed
108461
The Electronic Data Systems contract to manage the U.S. Navy/Marine Corps Intranet has been plagued by problems and earlier this year prompted an inquiry from the SEC.