Foreign hackers seek a soft target at VA

At least eight foreign state-sponsored hackers may have compromised IT systems at the Veterans Affairs Department, putting the personal information and medical records of veterans at risk, according to the June 4 congressional testimony of former VA Chief Information Security Officer Jerry Davis.

Davis, who is now the CIO of NASA's Ames Research Center, painted a picture of a security environment in shambles at VA, the result of what he described as "15 continuous years of unattended and undocumented material weakness in IT security controls."

The attacks were possible, Davis said, because of inadequate technical controls, including lack of encryption, weak authentication and easily exploited web applications. Attacks from foreign cyber-espionage units "continue at VA to this very day," he said.

Members of the Oversight and Investigations panel of the House Veterans Affairs Committee blasted the VA's conduct and aggressively questioned acting CIO Stephen Warren about alleged mismanagement of IT security. "The entire veteran database in VA, containing personally identifiable information on roughly 20 million veterans, is not encrypted, and evidence suggests that it has repeatedly been compromised since 2010 by foreign actors, including in China and possibly in Russia," said Subcommittee Chairman Mike Coffman (R-Colo.)

Later this month, the VA's inspector general will release a report that includes 32 recommendations for improvements to security policy. Testifying at the hearing, Linda Halliday, the assistant inspector general for audits and evaluations, said that VA's systems are inconsistently managed. In March 2013, she said, her department found that the agency was "transmitting sensitive data including [personally identifiable information] and internal network routing information over an unencrypted telecommunications carrier network."

Network trespassers compromised the domain controller of the network, according to Michael Bowman, the director of IT and security audits for the inspector general's office. The intruders gained access to email, taking information from the senior leadership at VA. Perhaps most damning, Coffman said in his opening statement, is that VA leaders are aware that foreign hackers have compromised the network, but are not sure what was stolen because the intruders encrypted the data they took.

Against this backdrop, Warren offered context about the size and scale of IT at Veterans Affairs, with 400,000 users and 750,000 devices. However, committee Republicans pounded on Warren when he wouldn't specify the extent to which VA systems had been compromised by foreign intruders, where those intruders were based, and what data might have been stolen. Warren did offer to discuss such matters in more detail in a closed session of the subcommittee, citing the sensitivity of the information.

Warren was also called on the carpet for allegedly hounding Davis to sign authority to operate (ATO) certifications for more than 250 systems, before he was cleared to leave VA and take up his new post at NASA -- a conflict that FCW reported on May 1.

A memo from VA secretary Eric Shinseki assured the committee that "VA's security posture was never at risk" as a result of the extension of these ATO certifications. Warren, who ghost-wrote the memo on Shinseki's behalf, told lawmakers that the statement was accurate within the context of ATO certifications, but was not accurate with regard to the overall vulnerability of VA systems.

Republican members on the panel did not have much patience for such fine distinctions, frequently interrupting Warren's testimony with pointed yes-or-no questions and reminding him that his testimony was being given under penalty of perjury.

Warren said that he has accepted the recommendations of the Inspector General's report, and is putting into place all of its recommendations. Based on prior internal and external evaluations, the VA in 2012 adopted a system called Continuous Readiness in Information Security Program (CRISP), and this will be fully phased in across VA networks by the end of 2013. Over the past year, the VA has trained 98 percent of staffers on information security, and the agency is only prevented from reaching 100 percent because of turnover in personnel, Warren said. He also cautioned against conflating risk with actual vulnerability.

"When a review takes place, the review is of what could happen. The existence of risk is not the same as removal of information out of the network," Warren said. While he could not guarantee that the VA systems or any computer system is 100 percent secure, he cautioned against panicking veterans about the vulnerability of their data.

"I believe we would be doing veterans a disservice by telling them there's a disproportionate risk. I would hate for this to drive folks away from taking advantage of the benefits they've earned and they need," Warren said.