[SpaceNews] A cyberattack that may have compromised information about current and former NASA employees is only the latest sign of ongoing information security problems that have plagued the agency for years.
In a Dec. 18 memo to NASA employees, Bob Gibbs, assistant administrator for the office of human capital management, said that the agency was investigating a “possible compromise” of NASA servers first detected in October. Those servers, he said, stored personally identifiable information about NASA personnel, including Social Security numbers. The memo was first published by NASA Watch.
“NASA and its Federal cybersecurity partners are continuing to examine the servers to determine the scope of the potential data exfiltration and identify potentially affected individuals,” Gibbs wrote, saying that process would take time. “The ongoing investigation is a top agency priority, with senior leadership actively involved.”
The scope of the data breach is unclear, but Gibbs said in the memo it could affect both current NASA civil servants as well as those who joined or left the agency, or transferred between centers, as far back as July 2006. He said that when it knows who has been affected, NASA will contact them to provide more information including providing identity protection services. Systems related to the operation of NASA missions were not compromised, he added.
“Our entire leadership team takes the protection of personal information very seriously,” Gibbs wrote. “Information security remains a top priority for NASA.”
However, NASA’s cybersecurity efforts have been criticized for years by its own Office of Inspector General (OIG), who has noted in a series of reports shortfalls in overall information technology (IT) management as well as security issues in particular.
“Through its audits, the OIG has identified systemic and recurring weaknesses in NASA’s IT security program that adversely affect the Agency’s ability to protect the information and information systems vital to its mission,” the office stated in its latest semi-annual report, dated Oct. 31. 
|
