Los Alamos beefs up security in wake of data breach

Jim Carr May 22 2007 19:39

The theft of classified information by a contractor's former employee has forced the Los Alamos National Laboratory to implement a variety of tactical and strategic security policies commonly found in a private enterprise.

The lab has disabled all ports, including USB ports, on classified computers — some via physically gluing the port shut, others with locking devices or software — and has begun encrypting personal information on laptop hard drives.

Meanwhile, Jessica Lynn Quintana pleaded guilty in U.S. District Court in Albuquerque, N.M., last week. Hired by the northern New Mexico laboratory to archive classified information, Quintana faces up to one year in jail, five years of probation and a $100,000 fine.

Quintana admitted in her plea that when she was working in a secure area at the lab on July 27, 2006, she printed pages of classified documents and downloaded other classified data onto a USB drive, then carried the data home in a backpack, according to the U.S. Department of Justice. The government didn't say why she took the information.

In addition to disabling USB ports and encrypting laptop hard drives, the lab has "significantly reduced risks in both cyber- and physical security [by] reducing and consolidating classified holdings" since the theft, according to a lab spokeswoman reached by SCMagazine.com, and who requested anonymity. "All of our classified systems have been inspected and found to be compliant, and we have reduced the number of standalone classified systems by 28 percent."

The lab also began construction on what it calls "a super vault-type room, the first of its kind," according to the spokeswoman. The vault, or data center, will allow the lab to "consolidate and uniformly control classified information managed by security professionals. By constructing additional super vault-type rooms, we'll reduce the number of classified vaults to an absolute minimum."

In addition, the lab has instituted searches "of all belongings carried by those escorted both in and out of the vaults."

In the area of policy and social engineering, the lab has "uniformly trained our information systems security officers, our ISSOs, and is hiring senior ISSOs in all key organizations to provide consistency across the laboratory," according to the spokeswoman.