recommended reading

Thousands of Weather Satellite Bugs Won’t Be Fixed For Years

The Joint Polar Satellite System

The Joint Polar Satellite System // NOAA

The Commerce Department inspector general is blasting a federal climate-satellite program and its supporting contractor, Raytheon, for ignoring tens of thousands of major cyber vulnerabilities.

The weaknesses identified in a new IG memo could impair machines controlling the Joint Polar Satellite System, the nation's next-generation fleet of polar orbiting environmental satellites. 

The ground system routes information for the National Oceanic and Atmospheric Administration and the Pentagon, as well as other U.S. and foreign government agencies. NOAA, part of Commerce, manages the information technology system. 

The system’s critical vulnerabilities have spiked by more than 60 percent since 2012, increasing from 14,486 security holes to 23,868 holes. 

High-Risk Vulnerabilities Persist

In 2010, NOAA began modifying the ground system to support satellite upgrades. But, “until 2014, the program did not require the ground system contractor to begin full implementation of the majority of the security controls for the system," Allen Crawley, assistant IG for systems acquisition and IT security, said in the memo. As a result, "many high-risk vulnerabilities exist within the system."

The government increased Raytheon's now-$1.7 billion contract by $185 million in February to strengthen information security and speed data delivery, company officials said at the time. 

The "high-risk vulnerabilities" cited by the IG refer to system weaknesses that make it relatively easy for hackers to gain control of computer components.

"If exploited, these vulnerabilities may make it possible for attackers to significantly disrupt the JPSS mission of providing critical data used in weather forecasting and climate monitoring," Crawley said in the memo, which was released Tuesday.

The satellites controlled by the system track data on oceans, ozone, snow, vegetation and other environmental indicators to help scientists discern changes in the Earth's atmosphere. 

But hacker tools are already available on the Web to exploit several of the weaknesses, Crawley noted. 

The security problems listed include:

  • More than 9,100 instances of high-risk flaws discovered during vulnerability scans, such as outdated software versions, programs that were missing bug fixes, incorrectly configured software, and excessive user privileges for accessing operating systems and software. 
  • More than 3,600 cases where password and audit settings were misconfigured.
  • Unnecessary software applications that need to be removed or disabled.

"The majority of these issues will not be remediated for another two years," Crawley said. 

The good news is that some of the vulnerabilities could be mended immediately, if NOAA demanded faster response times from Raytheon.

"Urgent updates to the JPSS ground system were not performed because the program did not require that the ground system contractor remediate vulnerabilities in a timely manner," Crawley said. 

NOAA Behind in Applying Security Patches

Agency policies mandate that high-risk issues be fixed within 30 days but in practice, patches were only applied about once a year. 

NOAA officials told the IG updates were delayed because of the 2011 liftoff of the program's first satellite -- Suomi National Polar-orbiting Partnership -- and an audit of Raytheon's work.

The agency is on schedule for a launch of a second satellite, JPSS-1, in early 2017, NOAA officials said in June. 

Tuesday's memo follows a scathing IG assessment of NOAA's overall satellite security posture in July.

Among the blunders detailed: a hacker stole satellite data from a contractor's personal computer, after which the employee refused to turn over the machine for investigation. Unauthorized smartphone use on critical systems also turned up during the audit. 

IG: Security Concerns Justify Special Attention

On Tuesday, Clark Reid, the Commerce IG's legislative and external affairs officer, said in an email significant security concerns involving the Joint Polar Satellite System ground system "justified special and separate attention” in a new memo.  

In written remarks responding to a draft memo, NOAA officials said they already are working to address the IG’s findings by, for example, neutralizing the Heartbleed superbug, a vulnerability in widely-used encryption software. 

The agency "successfully used expedited processes to enable remediation of Heartbleed in an accelerated manner" between April and June, Vice Adm. Michael Devany, NOAA deputy undersecretary for operations, said in the July 25 correspondence.

Raytheon officials told Nextgov they had not read the report and referred questions to NOAA. Agency officials Tuesday said they had no additional comment. 

Threatwatch Alert

Social Media Takeover

Qatar News Agency Says Hackers Published Fake Stories

See threatwatch report

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.