Earlier this week, Homeland Security Secretary Janet Napolitano announced what was touted as a "major aviation security milestone". Specifically, she claimed in a news release that 100 percent of passengers traveling within the United States and its territories are now being checked against terrorist watchlists through the Transportation Security Administration's Secure Flight program—a major step in fulfilling a key 9/11 Commission recommendation. Not so fast, Janet!
According to the executive summary of a just-released report from the Department of Homeland Security Inspector General Richard L. Skinner, there are serious flaws in the system:
Systems within the headquarters' enterprise Active Directory domain are not fully compliant with the department's security guidelines, and no mechanism is in place to ensure their level of security. These systems were added to the headquarters domain, from trusted components, before their security configurations were validated. Allowing systems with existing security vulnerabilities into the headquarters domain puts department data at risk of unauthorized access, removal, or destruction.
And that's not all:
Also the department does not have a policy to verify the quality of security configuration on component systems that connect to headquarters. Interconnection security agreements are present for each connections between headquarters and components to secure shared services; however, neither the agreements nor other policy define specific security controls required for connecting systems. Stronger management and technical controls are needed on trusted systems to protect data provided by the department's enterprise wide applications.
What does this mean? The very people charged with protecting the nation from online and offline security threats appear to have failed when it comes to protecting their own information technology systems which, in turn, was supposed to help protect the flying public.
If you "speak" IT and are interested in a more in-depth discussion of the issues, click here.