GAO Says VA Not Alone in Data Carelessness

[Eugene]

GAO Says VA Not Alone in Data Carelessness


Wednesday May 24, 2006 9:16 PM

By LESLIE MILLER

Associated Press Writer

WASHINGTON (AP) - It isn't just Veterans Affairs. Personal information
about Americans isn't safeguarded properly throughout the government,
and the consequences could be disastrous, congressional investigators say.

The potential damage was shown this week in the disclosure that personal data
on 26.5 million veterans was stolen.

Veterans Affairs was one of eight departments given failing grades for computer
security practices in 2005. The Pentagon and the departments of Homeland Security,
State, Energy and Health and Human Services also got Fs from the House Committee
on Government Reform in its annual report card released in March.

"For many years, we have reported that poor information security is a widespread
problem that has potentially devastating consequences," Greg Wilshusen, the
Government Accountability Office's director of information security issues, told
the committee then.

<snip>

Full article: http://www.guardian.co.uk/worldlatest/story/0,,-5843238,00.html

Related thread: US says personal data on millions of veterans stolen

[lapfog_1]

1. And of course, government records are just the tip of the

iceberg.

A couple of years ago I was called in to do a security analysis for a large tax preparation firm. They had recently had a computer stolen from a branch office (they have these offices everywhere). The computer had 25,000 complete tax returns for individuals in the Northern California region, complete with all the information an identity thief could ever want.

They wanted to know what they could do about it.

I spent weeks preparing reports on data encryption services, centralized data servers (no databases on desktops or laptops), physical security (I think this is what they wanted the most... they didn't care about the data, just the equipment that was stolen) measures including RFID, security cameras, etc, etc.

In the end, they choose to do NOTHING... everything was too expensive to implement.

I do my own tax prep... and I do my own computer security.