Chat network used by Veterans Administration staff was a major security risk, investigation says

A chat network used by staff at the Department of Veterans Affairs (VA) was a major security risk and open to anyone who had ever been a contractor or an employee at the VA, an internal investigation found.

According to the VA’s office of the inspector general the chat software, a Microsoft product called Yammer, “did not have an administrator or system set in place to ensure removal of former VA or contractor employees”. Only an administrator could remove an employee from the system, so everyone who had ever logged maintained access to the service.

The report, published this week , found current employees of the department used it not just to share sensitive information but to exchange insults.

When quizzed about how exactly the network was supposed to stay secure without oversight, an official whose name is redacted from the document told the investigators: “It’s kind of like a self-policing, everybody’s job is to be responsible.”

Not everybody was not being responsible, the inspector general’s office found. One user figured out a way to make a digital copy of any VA employee’s ID card – which are keyed to multiple forms of ID and a set of fingerprints – and happily posted instructions on Yammer.

“Figured out how to copy the [Personal Identity Verification (PIV) Public Key Infrastructure (PKI)] Certificate to windows if a card is lost or not working,” wrote the user. “[A]ll the email encrypted with the certificate can still be accessed without the card.” The user then attached a post with helpful screenshots embedded entitled “Installing your PIV PKI certificates to your PC”.

“Although we found that the process he detailed did not successfully export PIV PKI certificates, he posted a process that he believed would directly circumvent VA’s IT security,” wrote the investigators.

Some users at least tried their best: “Please DELETE the .pdf with the IP address IMMEDIATELY!” read another post.

Others at the VA were aware of the problem, too, according to one exchange:

User 2: So, if someone leaves the VA and nobody sends a message to have that account suspended, can the former employee still participate in the VA Yammer groups?

User 1: Yes. They theoretically could. They just need to sign into yammer. Keep in mind, yammer is not behind the firewall, so anyone with a connection to the internet can gain access. Yep, even Hackers. Hmm, now that makes me curious about security.

William Cerniuk, the Veterans Health Administration technology director, said he had balked at the price of an upgrade for the service that would have made it more secure when pressed by investigators. Cerniuk “said that he found that the paid version cost ‘$30 a seat per year’ and that ‘it wasn’t worth paying’ for the fee-based enhancements of Yammer ‘over the free ... The free was good enough’”, according to the report.

Employees used the service to trade barbs, as well:

User 3: [Name], seriously. Why do you have to be so mean-spirited?[...] You’re a bitter bitter person and it just makes me sad for you. I’m done reading anything with your name on it.

User 4: Wow, [Name]! Is free speech banned on Yammer? And talk about mean spirited and name calling... Just Wow!

There were also concerns about the service’s general crumminess, the report’s authors wrote – messages often went to the wrong recipients, and emails with no relevant content from Yammer came thick and fast. “We further found that Yammer regularly spammed and excessively emailed users, as well as VA employees who had no interest in joining the site, and users were unable to remove the Online Now instant messaging feature, resulting in every user violating VA policy simply by logging onto the site.”

Microsoft declined to comment for this story.

The report came as a separate study by mobile security firm Lookout revealed that half of the more than 14,000 government employees it surveyed had used their personal mobile devices to access their official emails, and 49% downloaded work documents onto those devices irrespective of whether or not the device had been approved for use.

Many government agencies, including the Pentagon, do not yet have a bring-your-own-device program. A spokeswoman for Lookout confirmed that the respondents’ employers included “a healthy mix of intelligence, defense and civilian” agencies.

“You’ll hear a lot of people in security when these breaches happen say, ‘We need all these advanced controls!’” observed Steve Ward of IT security firm iSight. “And they’re right, but it’s also true that we aren’t even doing the easy stuff well. Clean up your house. Practice effective hygeine. Document your processes and adhere to them. It’s not shocking – I’ve left companies and still have credentials that still haven’t been turned off a year later.”

Ward noted that a lax approach to data security wasn’t unique to Hillary Clinton’s email accounts. “You shouldn’t be able to access your assets on the network with a device that isn’t approved,” he said. “If you aren’t creating, enforcing and monitoring policies, you’re setting yourself up.”

guardian.co.uk © Guardian News and Media 2015