This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--1457021584-2029410977-1195455998=:26511
Content-Type: TEXT/PLAIN; CHARSET=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-ID:  

http://www.gcn.com/online/vol1_no1/45450-1.html 

By Wilson P. Dizard III
GCN.com
11/16/07 

A recent series of intrusions into the Earth Observing System=E2=80=99s networks 
=E2=80=9Ccost NASA $1.5 million for incident mitigation and cleanup costs 
alone,=E2=80=9D said the agency=E2=80=99s inspector general, Robert Cobb, in a memo 
issued Nov. 13.

Those costs came on top of the =E2=80=9Coperational impact to the agency=E2=80=98s 
mission, such as the temporary suspension of automated processes,=E2=80=9D 
caused by the criminal hack of the networks, Cobb said. The memo was 
addressed to NASA=E2=80=99s administrator and accompanied the IG=E2=80=99s report titled 
=E2=80=9CNASA=E2=80=99s Most Serious Management and Performance Challenges.=E2=80=9D

=E2=80=9COur criminal investigative efforts over the past five years confirm 
that the threats to NASA=E2=80=99s information are broad in scope, sophisticated 
and sustained,=E2=80=9D auditors wrote in the report.

=E2=80=9CEven more troubling is that the threats appear to evolve along with new 
technologies and range from low-end hacking to complex attacks aimed at 
some of NASA=E2=80=99s most sensitive data,=E2=80=9D the report states.

=E2=80=9CIn addition, internal and external audits and reviews of the agency=E2=80=99s 
[information technology] security continue to identify systemic 
management and technical and operational control weaknesses,=E2=80=9D the report 
states. Those weaknesses menace the confidentiality, integrity and 
availability of the agency=E2=80=99s data and systems.

NASA should protect its computers by launching an =E2=80=9CIT security internal 
control program; enhancing intrusion detection and computer forensics 
with incident management analysis; implementing improved NASA network 
security monitoring capabilities; and managing IT asset and [IP] 
addresses,=E2=80=9D the report states.

NASA has taken significant actions to curb the hacker threats posed by 
criminals; national military and intelligence forces; and malicious 
vandals, the auditors found. But a shortage of fully trained security 
personnel, poor patch management and haphazard incident response have 
hindered progress, the report states.

However, the hacker risk could pale in comparison to NASA=E2=80=99s tendency to 
be its own worst enemy with regard to financial management and 
procurement practices.

After years of attempting to build a financial management system that 
could span the agency=E2=80=99s 10 centers and deliver timely, accurate 
financial data =E2=80=94 a task mastered by much smaller enterprises inside and 
outside government=E2=80=94 NASA doesn=E2=80=99t appear close to its goal.

The auditor=E2=80=99s report states that NASA has not mastered double-entry 
accounting =E2=80=94 a technology that dates back to the Middle Ages =E2=80=94 well 
enough to produce timely, accurate financial statements on a routine 
basis.

The auditors described a NASA accounting approach that might be 
characterized as whimsical or madcap. Officials decide how much of their 
expenditures to allocate to capital accounts only after the 
disbursements have been made, according to the report. They also rely 
heavily on contractors to identify assets the contractors created, 
auditors said.

The multibillion-dollar agency=E2=80=99s retrospective financial management 
method, which resembles that of bankrupt musician Willie Nelson or a 
financially embarrassed starlet with driving issues, resonates with its 
Scarlett O=E2=80=99Hara procurement approach of =E2=80=9CI=E2=80=99ll worry about that 
tomorrow,=E2=80=9D according to the IG report.

=E2=80=9CGiven that NASA expends most of its budget through contracts and other 
procurement vehicles, weaknesses in NASA=E2=80=99s acquisition and contracting 
processes pose significant challenges to the agency=E2=80=99s ability to make 
informed investment decisions,=E2=80=9D the report states.

The Government Accountability Office first warned that NASA=E2=80=99s inadequate 
methods for tracking acquisition costs and contractors=E2=80=99 activities were 
serious problems 17 years ago.

The agency continues to experience failures in =E2=80=9Cdeveloping adequate cost 
estimates, managing program costs, and ensuring that NASA is using the 
most advantageous acquisition and procurement strategies and safeguards 
to promote competition in contracting and to maximize the agency=E2=80=99s 
ability to fulfill its missions,=E2=80=9D the auditors wrote.


--1457021584-2029410977-1195455998=:26511
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/ 
--1457021584-2029410977-1195455998=:26511--