VA cuts telework, bans employee-owned computers

[The Straight Story]

VA cuts telework, bans employee-owned computers

By Daniel Pulliam
[email protected]

The Veterans Affairs Department has suspended use of employee-owned computers for official agency business and has limited telework at one of three major divisions, in an effort to prevent security breaches.

The agency also is issuing a directive reminding employees that failure to comply with department policy regarding the protection of personal data could result in administrative, civil or criminal penalties, VA Secretary James Nicholson testified Thursday at a House Government Reform Committee hearing. The panel called the hearing to discuss the department's response to the early May theft of sensitive records from the home of a VA employee.

A June 6 directive to the Veterans Benefits Administration bars employees from removing claim files from their offices to work on them from alternative locations, such as their homes. From June 26 until June 30, all VA facilities will observe a Security Awareness Week.

Nicholson said about 35,000 employees have some level of access to the department's servers through a virtual private network, also known as a VPN, for the purpose of off-site access such as at an employee's home.

http://www.govexec.com/story_page.cfm?articleid=34291&dcn=todaysnews

[Redstone]

1. Typical Government response...instead of putting security policies

in place, they lower their efficiency. Brilliant.

Redstone

[Tempest]

2. The VPN is not the problem

The problem is that the government doesn't require the computers to be encrypted as a prerequisite to using them on their network.

This problem isn't limited to the VA by any means.

[BlooInBloo]

3. Hm. Isn't that one *part* of a decent overall data-security solution?

Or am I supposed to be outraged somehow?

Seems like a decent step to me, keeping agency data on agency computers...

If you disagree, that's cool, just please don't strawman me as if I said anything like "yah! that's 100% of the solution - nothing else is needed".

[William Seger]

4. My company has the same policy...

... and the company computers that are allowed on the LAN and the VPN all have a "corporate image" OS with security settings and software that can't be changed or disabled. It's just basic self-defense -- intrusions and viruses can be very expensive.