Industry


Ads by TechWords

See your link here


Martin McKeay's picture
Martin McKeay

Security Matters

I received my VA letter yesterday

Yesterday a thin white envelope came in the mail from the Veterans Administration.  At first glance, I thought it was about my student loans, but I quickly realized it was something a lot more important and potentially costly.  I finally received notification from the VA about the loss of 26.5 million veteran's records.  I was not in the least bit impressed by the VA's response.

If you'd like to see a reprint of what the letter says, check out Kevin Devin's post at In The Trenches.  Or ask a couple of your neighbors; with the size of this breach, I'm sure more than a couple people in your neighborhood have received the same letter.  You might check with members of your family too.  This isn't a minor breach, it potentially affects almost 10% of the entire population of the United States.  And the best the VA can do is send out a letter stating, "Authorities believe it is unlikely the perpetrators targeted the items because of any knowledge of the data contents."  Do they really believe this?  And does that matter?

This letter drove home for me how little the Veterans Administration really understands about what has happened and what they've done wrong.  They continue to try and minimize the apparent impact of the situation by stating it wasn't really all that big of a deal and by making knee jerk reactions, like ending telecommuting.  But these really aren't addressing the problem with what's already out there and how they're going to protect veterans from having their identities stolen.  It's great to 'believe' that the perpetrators don't know what they've got, but the VA needs to take steps to make sure veterans are safe, even if the thieves really have figured it out.  Sending a letter isn't enough.

What People Are Saying

Eric C recommends that

Eric C recommends that telecommuters leave sensitive files on servers back at the office and use encryption when accessing them. Good idea which I often use. But I have found, when making lengthy changes at home to a large file with sensitive information, that frequent saves back to the office servers is often very slow because my “fast” broadband connections via DSL or cable are asymmetric, with the uplink speed throttled back to a tiny fraction of the fast downlink. (Downlink speeds have been increasing significantly, but not uplink speeds.) The solution to enabling more efficient and safer telecommuting is faster UPLINK speeds, something that current ISPs do not seem interested in.

What I find interesting is

What I find interesting is that when I got out of the service, I applied to the VA due to injuries received in Vietnam. I spent 7 years fighting and arguing with them, and was told that because my records had been lost in the fire at St. Louis, there was nothing they could do. Yet this same organization that couldn't find any trace of my records is able, after almost 35 years and many moves, to send a letter addressed to me at my current location explaining their problem with the missing data. If this isn't ironic, I don't know what it is.

If the VA were to provide

If the VA were to provide some sort of credit monitoring, where do you think that money (26.5million * $100.00 = $2.65billion) would come from? Higher taxes? Decreased services? So, we all take a financial hit for something that might happen to a few? Not sure that's the solution.

It seems to me that if the

It seems to me that if the VA is not going to provide credit monitoring services to us, the Fed could at least provide a tax credit to those who go out on their own and get it. BTW, to those of us who went to 'Nam and returned to public scorn and VA indifference, this all feels just about normal.

Goose, Don't be too quick

Goose,
Don't be too quick to call that truck driving school, truckers have their own huge pile of government junk to cope with, along with thieving brokers, long hours, moron loading dock bosses, highways full of idiots driving recycled japanese beer cans and other idiots emptying the beer cans while driving. Hang in there where you are, you sound like the kind of guy I'd like to hire if I had my own business.

I'm an IT manager for a

I'm an IT manager for a small corporation. The company just barely falls into the scrutiny of Sarbanes-Oxley compliance issues based on our financials, and it is absolute murder trying to comply, us being a small company.

Lean and mean, we had just one person doing HR and Payroll, another doing Payables and Receivables, another doing Billing and Collections, and I was the sole IT guy. We were highly efficient, responsive, competitive and vital. Enter Sarbanes-Oxley compliance policies. Simple segregation of duty requirements dictated by Sarbanes-Oxley compliance required that we hire more people, to double our original size, just so we had enough people here to look over each other's shoulders and cover each other's butts and sign endless reams of paper attesting to the fact we were doing both. Fortunately, the man hours involved in performing all of those vital compliance tasks (over-shoulder watching and butt covering) now keeps what would have been nearly a dozen idle hands endlessly busy watching over shoulders, covering butts and signing papers. Unfortunately, we get half the work done using twice the people. If we keep up this way, we'll lose enough revenue to fall outside of Sarbanes-Oxley compliance requirements. Wonderful!

The outcry for shortcuts is continuous and piercing, from all directions as you can well imagine, because our labor costs doubled while our efficiency and service halved. When what would have been a 30 second job prior to Sarbanes-Oxley for me to modify a user's access or apply a patch to fix an issue, becomes a hours-long ordeal of getting the correct people to submit and sign off on a dozen sheets of paper, to authorize me to do that task.

Stressed? Hell yes! I am seeing the company I'm working for getting shafted right out of business due to a bunch of useless government-dictated red tape. But being stressed out about performing work at a snails pace is far better than getting acquainted with a new cellmate if I do knuckle under to the outcries and my own desire to see the company prosper, and take shortcuts to speed things up. So do I understand people wanting to take shortcuts? Yes, I do. What will be the result of all this scrutiny in the VA data theft? Even more red tape and more stress, and more shortcuts, because of more knee-jerk regulation.

"Hey, Mav, what's the phone number to that truck driving school?" -- Goose, Top Gun

With all the publicity from

With all the publicity from every news agency in the country, do you really believe that the thief doesn't know what is on the stolen computer? I think the VA is only trying to cover its backside and diffuse the wrath of veterans and our representatives.

How could anyone be so imbecilic as to think that having a laptop, at home, with millions of vets data on it might be secure? There should be some criminal penalties for such actions.

I agree with others that the VA now has the responsibility to do all it can to monitor and protect against any use of the stolen data. This must be considered a major crisis, not merely an "inconvenience."

Unfortunately, this is another example of a larger issue, namely trust in our government. I don't know of a single adult who trusts our governmental or political systems anymore.

Additionally, as a teacher, I now see an entire generation of young people who have given up on our system of government. Their rhetoric in this area is almost entirely negative.

Who in our government today has the courage to be honest and forthright?

Re: VA Letter....I received

Re: VA Letter....I received the same letter too & what amazed me the most is that the Federal Government actually admitted that one of their employees made a mistake & broke the rules. It is refreshing to see some honesty from the Feds instead of the usual Washington political spin.

I also received a letter

I also received a letter from the VA. I was already aware of the possibility that my personal information may have been stolen. I requested and received a credit report form Equifax. I have decided to purchase a credit monitoring services. I believe the best course of action for veterans is to go on the offensive. Take responsibility for your personal data. Limit the amount of data that you provide to others and review your credit report on a regular basis.

The big difference between

The big difference between this letter and others I have received is the lack of assumption of any responsibility on the part of the VA. Companies in the private sector have paid for credit monitoring (usually between $85 and $140 per person) while the VA levies this responsibility on us veterans. Of course, for the private sector companies, the cost of this service is a cost of doing business and thus at least partially deductable as a business expense. For governement agencies, it is an unbudgeted cost. No budget, no service. The folks who risked their lives for their country, once again, get shafted by their government.