NASA is developing mobile device management to better protect its networks, according to CIO Larry Sweet.
NASA is one of the few agencies that allows employees to access agency email and other systems from personal mobile devices.
But that perk appears to be undermined by lax security practices and weaknesses in NASA’s mobile device management capabilities, according to a Feb. 27 audit.
As of September, NASA required all devices that connect to its email system to have a four-character password, automatic lock, use encryption and delete all data after 10 failed log-on attempts, according to the inspector general’s report. But NASA has work to do in mitigating risks for mobile devices that connect to other systems and networks, such as the the wireless local area networks at the NASA Centers.
In response to the IG report, NASA Chief Information Officer Larry Sweet said his office is implementing an enterprise mobile device management capability to centrally manage personal and government-furnished devices, as well as those purchased from the agency’s IT contract with HP Enterprise Services.
But installing that capability is estimated to take up to a year, and wouldn’t be completed until February 2015.
Meanwhile, the IG also reported that NASA does not have a complete and accurate inventory of agency-issued smartphones, tablets, cell phones, and AirCards. This is because the information system NASA uses to order IT equipment from HP is not fully functional or integrated with the database it uses to track IT assets, according to the report.
In addition to security concerns, NASA’s weak management practices means the agency cannot ensure whether it’s paying for unused devices.
“In 2013, HP reported that 2,280, or 14 percent, of agency-issued mobile devices went unused for at least seven months,” the report noted. The IG estimates the unused devices cost NASA more than $679,000.
“Until NASA resolves its asset inventory and data quality issues and strengthens controls over agency-issued mobile devices, agency funds will continue to be wasted on unused devices,” the report said.
NASA agreed with the IGs recommendations and is validating the assignment and invoicing of its mobile assets.