Los Alamos National Lab missing 67 computers
One security incident involves BlackBerry loss in 'sensitive' foreign nation
Computerworld - New Mexico-based Los Alamos National Laboratory (LANL), the nation's leading nuclear weapons lab, once again finds itself the focus of concerns about potentially serious cybersecurity lapses.
The Project on Government Oversight (POGO), a watchdog group, yesterday released a memo from the Department of Energy's National Nuclear Security Administration (NNSA) expressing concern over the theft of three computers from the home of an employee at Los Alamos National Security LLC (LANS) in January.
The Feb. 3 NNSA letter expressed frustration at LANS's lackadaisical response to the theft and the apparent lack of controls aimed at preventing such incidents in the first place. It noted that follow-up inquiries about the January incident revealed that as many as 67 LANS computers are currently "missing" from the lab, including 13 that are known to have been lost or stolen. It is not clear yet whether any of the computers contained classified or sensitive information.
The memo noted that LANS originally treated the January thefts as a "property management issue." As a result, the DOE did not learn of the missing hardware right away, limiting its ability to respond quickly to the potential loss of sensitive information, the DOE said in its letter. The agency also hit "significant weaknesses in individual controls," configuration management and accountability, and said it is still unsure about the "magnitude of exposure and risk."
Ingrid Drake, an investigator for the Washington-based POGO, said the NNSA memo shows that it feels "it has been kept out of the loop" regarding potential security lapses at LANS. It is also significant that there is continuing uncertainty whether the missing computers contained sensitive or classified data, she said.
"They say, at best, there is no sensitive information," Drake said. That suggests that no system is in place for knowing what kind of information is contained on computers used at the laboratory, or if there is one, that it isn't functioning as it should, she said.
A spokesman for the NNSA referred a request for comment on the missing computers to LANS officials, who did not immediately respond to a request for comment.
The latest revelations highlight LANL's continuing cybersecurity woes. In July 2007, the DOE proposed levying a record $3 million fine on the University of California and a separate $300,000 fine on LANS for alleged failures to protect classified information in an October 2006 security breach. The formal enforcement actions against both organizations followed months of investigation into the breach, in which a contract worker at LANL illegally downloaded and removed hundreds of pages of classified data from the site via USB thumb drives.
Barely a month earlier, the laboratory was the subject of scathing criticism by lawmakers after it was discovered that several LANS officials used unprotected e-mail networks to share highly classified information related to the characteristics of materials used in nuclear weapons.
In June 2000, several computer disks containing classified information on how to disarm Russian and American nuclear devices were found to be missing from a secure storage area.
In addition to those problems, LANL on Jan. 28 warned nearly 1,900 employees and visitors about possible exposure to beryllium based on recently discovered beryllium contamination at one of the lab's technical areas. Beryllium is a non-radioactive but hazardous material with many applications in electronics, aerospace and weapons work, the laboratory noted.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts