From NextGov:

A Defense Department inspector general is initiating a review of a National Security Agency crackdown on computer users who have access to too much information. 

Be it a rogue contractor or an unknowing employee with sloppy login and logoff habits, insiders are a major threat to U.S. secrets, say researchers and federal officials

Congress has taken notice.

A classified addendum to the 2016 Intelligence Authorization Act contained an “inspector general classified reporting requirement” relating to NSA internal security protections, according to a Jan. 6 memo from Carol Gorman, assistant IG for readiness and cyber operations. 

“Specifically, we will determine whether National Security Agency processes and technical controls are effective to limit privileged access to National Security Agency systems and data and to monitor privileged user actions for unauthorized or inappropriate activity,” she said in the document, which was addressed to top brass at the Pentagon.

In the wake of excessive downloading by ex-NSA systems administrator Edward Snowden, the agency has been trying to keep a closer eye on users with sweeping access to files. For example, as of 2013, there is a “two-man” policy that two people must be present when sensitive information is read or moved.  

The insider-threat inspection is scheduled to start this month. 

It is one in a series of reviews of safeguards in place to protect the NSA network and infrastructure. The whole audit will examine whether its controls have actually improved the security of the agency’s “systems, data and personnel activities,” Gorman said. 

She said she is open to suggestions from management on adding…

Continue Reading