Friday (7/7) the Naval Safety Center (NSC) reported personal information on more than 100,000 Navy and Marine Corps aviators and aircrew had been posted on its public Web site for over 6 months.  The data reportedly included Social Security numbers for current active-duty and reserve aviators and aircrew, and potentially every Navy and Marine aviator who has actively served in the past 20 years.

"The same personal information was contained on 1,083 Web-enabled safety program disks mailed to Navy and Marine Corps commands, according to an NSC statement. The center’s Web site has been shut down since July 7."

And yes, they had a similar incident just weeks ago.

"In late June the Navy Personnel Command (NPC) said it had discovered that personal data – including Social Security numbers and birthdates – on 28,000 service members and their family members had been published on a civilian Web site."

Where are the controls over this sensitive information?  If this is simply human error, where is the oversight?  Why isn't someone checking these sites continuously to ensure nothing inappropriate is getting posted?  What are the policies and procedures in place to protect this type of information?  ARE there policies and procedures in place?

Hackers don't need to break into most networks to get confidential information; they can just keep an eye on websites for whenever the information is posted.

The Navy, and probably every other government agency, needs to do a privacy impact assessment (PIA) to find where their other privacy breach risks exist, and they need to ensure security and privacy are built into their SDLC process to help keep this type of incident from happening.  And, of course, it definitely appears that their information security and privacy awareness and training efforts could be beefed up.

And yes, government agencies ARE required to do annual PIAs...but are they being done effectively?  It seems a lot is getting overlooked based upon the ongoing security breaches.

Technorati Tags
information security
IT compliance
privacy training
awareness and training
personal information breach
military information security
Navy privacy breach
privacy