Re:Personal data for more than 130K U.S. Navy sailors hacked
by beowulf_cluster on Thursday November 24, 2016 @11:12AM
(#13031008)
Regarding 3: The encryption scheme we put into place probably isn't going to slow down a motivated actor. We have master decryption passphrases that are regularly disseminated among the admins and could foreseeably end up in the wild (if nothing else, it wouldn't be difficult to social engineer).
And recently, we've started transitioning to new encryption software. Our implementation of the software prohibits more than one encryption passphrase per machine. So, in order to share machines between employees, organizations have begun sharing the same passphrase across all the organization's machines.
Source: HPES employee working on NASA ACES contract
1 :
>A NASA inspector general report this year determined 48 NASA laptops and mobile computing devices were lost or stolen between April 2009 and April 2011, many containing sensitive data.
http://www.reuters.com/article/us-space-nasa-security-idUSBR...
2:
Personally identifiable information of "at least" 10,000 NASA employees and contractors remains at risk of compromise following last month's theft of an agency laptop, a spokesman told Computerworld via email Thursday.
http://www.computerworld.com/article/2493084/security0/nasa-...
3:
NASA decides to encrypt all their laptops, because PEOPLE STORE SENSITIVE INFORMATION UNENCRYPTED on laptops that they take home.
https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12)....