NASA Found Guilty of Sucking at Security!!!

On March 28, 2011 the Inspector General for NASA published a report detailing the  "Inadequate Security Practices" observed on NASA critical networks. The highlights include the following:

- Six Internet facing servers had critical vulnerabilities

- Exposed encryption keys

- Encrypted passwords

- User-account information 

I understand that vulnerability scanning and patching across a large enterprise can be a difficult task. Most government installations have a difficult time maintaining and managing their assets. I get it. But what is inexcusable is that this could have endangered "various missions, including controlling spacecraft like the International Space Station and conducting science missions like the Hubble Telescope." But wait, it gets worse! These flaws could have been prevented and "occurred because NASA had not fully assessed and mitigated risks to its Agency-wide mission network and was slow to assign responsibility for IT security oversight to ensure the network was adequately protected." This was something that was brought to their attention in May 2010!

Linda Y. Cureton, NASA CIO

NASA you've gone too far this time! In the days of APT and countless waves of spear phishing campaigns I cannot believe there are agencies out there who still don't have active vulnerability discovery and patching programs. NASA, there is no excuse for failing this miserably! Can somebody please get this organization some help?