Chapter 8 - VA Case Study

Question #1 - List and describe the security weaknesses at the Department of Veterans Affairs.
The VA had two major security weaknesses in the way they protected their data. There were poor physical security measures and information security measures were both to blame for this incident.
Institutional guidelines for physical security should have not allowed the entire database to be copied to a laptop. There is seldom any need for a centrally managed database to be transferred to a laptop since any changed made to the data by working off site will not be incorporated into the main database. Synchronization of such a massive database would not be reliable and thus the need for the data to be transported would be minimal.
The information should have been encrypted and password protected if there truly was a need for this employee to carry this data with him.

Question #2 – What management, organization, and technology factors contributed to these weaknesses?
Management – While one may not think of it as a weakness, the management’s reluctance to report the stolen laptop and the contents of the hard drive contributed to the difficulty in finding the laptop before the data was compromised.
Organizations – VA operations should have limited the data accessible to the employees to only the data needed in order to effectively do this job. Lack of promoting the sensitivity of the data led to a careless attitude regarding the protection of the data.
Technological – At a minimum the data should have been encrypted and password protected. As a practical measure, the laptop should have been protected at the BIOS level if that sensitivity of data was contained.

Question #4 – What solutions would you suggest to prevent these security problems?
As stated before, I cannot envision a need when this data retains any value once it is removed from the main database. It quickly becomes outdated as maintenance is done to the main database. If after hours access is required to complete the work on such a regular basis, then the agency needs to consider hiring another individual to allow the work to be completed during regular business hours thus eliminating the need for the data to be removed from the facility. If access to the data is required remotely then I would recommend an online system with the most secure connection possible.