Information Security Program Survey of the Department of Veteran Affairs - Term Paper Example

Information Security Program Survey of the Department of Veteran Affairs due: The United States sector of Veteran Affairs is the second biggest sector in the United States, and a government-run military Veteran benefit system seeks to offer benefits to American veterans. Thousands of people run the system, and a lot of information is collected in the process of managing the system. Most of this information is vital and private and so it should be kept private at all times. Information has been valuable from time immemorial. With the current advancements of technology, there has been convenience and easy access to information. However, this advantage comes with risks that valuable information can be changed, stolen, and or misused. Thus, the concept of information security has become fundamental, and up-to-date security trends must be carried out. Information security thus maintains data in a secure manner, protecting its availability, integrity, and privacy. The Information security program as envisaged by the United States Government Accountability Office (GAO) for the department of veterans affairs is to exert a pull and maintain individuals with skills in the field of information technology. This program has clear-cut and documented set of instructions. This guidelines show how the sector of Veteran Affairs handles protects its information assets, as well as making prospect resolution about the information systems security infrastructure. Information security program is as per the Department of Veterans Affairs (VA) Directive 6500, dated August 4, 2006. The department of Veteran Affairs (VA) works under a stern set of laws and regulation to ensure information security in their system. The department has strong policies that govern the running of its web sites, for example, the privacy policy. According to the Memorandum for the Heads of Executive Department and Agencies dated June 22, 2000, that talks of privacy policy on data collection on the AV Federal web sites, states that involved agencies are required by law and policy to follow clear privacy policies in the web activities and to observe the policies at all times. Involved parties are also required by law to post clear privacy policies on the department’s web sites. Apart from this, involved parties are required to adhere to stated privacy policies, for example if an agency states that the information provided will not be available to any other parties, the agency ensures that there is no any kind of information sharing that takes place with another party. VA follows a set of regulations that categorizes the various compensation packages for the veterans. For one to benefit from VA, one must be a veteran. The VA does care for widows and orphans of war other than veterans themselves. This means that the number of beneficiaries is high, and there are measures that have been put in place to classify the various needs of the beneficiaries of VA to ensure that everyone is catered for accordingly. For example, most veterans become disabled in one way or another and, so the disability compensation is the most common compensation in VA. This compensation is divided into two groups according to when one got disabled. There is a group for those who were disabled when enrolling into the military, but there conditioned worsened, a group whose disability occurred during their time in the military and those whose disability occurred after their time in the military. These divisions help the VA to help these veterans according to their needs. Regulations also require applicants to provide evidence like medical records to justify their claims. Other claims that are open to veterans include; tutoring and training, vocational/rehabilitation and employment, home compensation, special groups among others. Laws that ensure only the genuine claims are compensated govern all these. The VA also has rules that make it possible to functions in a just manner without favor or unfairness to any group of persons and that make sure it to run without disputes. Policies of the VA are its laws. One has to abide by the stipulated policies otherwise they will be going against the law of the VA. What a policy states become the law. However apart from the policies of the VA, there is the Board of Veteran’s Appeals that is held to account for entering the final resolution on claims of entitlement to veteran’s benefits in place of the secretary of veterans affairs. The mission of the Board of Veteran’s Appeals is to carry out hearings, consider and dispose of appeals and issue quality decisions in compliance with the law. The decision of the board is however not final, and it can be appealed to the US Court of Appeals for Veterans claims. There is also the Board of Contract Appeals, which is a statutory Quasi-Judicial tribunal that hears and resolves appeals from resolution of contracting officers on claims concerning deals awarded by the VA or by any other agency. The VA therefore has a law system that handles its own disputes and states rules/laws to be tracked for the sake of order within the system. As stated earlier, the VA collects a lot of information that is private since this is personal information about the US war veterans. The information is secure, but the use of web technology and other technology can be used to follow the activity of users over time. Persons who are not even American citizen can finish this and they can use this information in a harmful way. The most common way of information tracking is the use of “cookies”. This tiny software is placed in a user’s hard drive and used to record information. With this risk of information being accessed by people who could use in a harmful way like identity theft and committing crime using someone else’s identity, one may ask how the VA maintains the confidences of their clients. According to the VA handbook 6500 dated September 18th 2007, the VA is aware of their client’s concerns and they have taken particular measure to ensure that the department compliance with the Federal Information security management Act of 2002 (FISMA) and the security of VA into systems administered by VA or on behalf of VA. These measures are supposed to ensure the confidentiality, integrity and availability of information and information systems to their clients. The VA offers training on information security to those responsible for the information. These include people like the senior officials, the information owners, the information system users and the office of the inspector general. These are the people responsible with the safekeeping of the information at VA. According to (VA handbook 6500, pg 24) on the issue of information security the VA runs by the policy that states that it will implement security control measures to manage effectively, reduce and eliminate the risk and vulnerability to reasonable levels of compliance with all federal security states. The operating unit is responsible for carrying out through risk assessments to identify and prevent potential risks, vulnerabilities and threats that would alter the confidentiality and integrity of information held by VA. This assessment covers various crucial areas like the operating units, the information systems, the information and the users. The assessment also checks on the probability of the occurrence of a potential threat and gives effective recommendations that are cost effective in order to reduce the operating unit’s exposure to threats like physical damage and theft. Training on information security also ensures that officials or parties involved differentiate between information that is private and that which is public. Private information is securely stored in such a manner that on unauthorized person can access it while public information is general information about the VA that can be viewed by the public for various reasons like public relations etcetera. The acquisition of service and the system has also been fully looked into in terms of security where the operating unit is the one that determines documents and allocates the resources required to effectively protect the information systems. The operating unit ensures that all third party providers of information apply adequate security control measures. Appropriate training is provided when using hardware, software, computer related services and when accessing the VA information systems. The VA has gone to great heights just to make sure that the information they have is not under any risk of being tampered with by outside parties. However, they have faced challenges over the past few years. The advancement of technology in Information Technology is the greatest threat that VA faces since this advancement has placed VA’s programs and its financial data at risk. The other problem that VA faces with information security is the lack of the organization’s consistency in on the method of dealing with information insecurity. VA has often had more than one method of fighting information insecurity in that it will start training its employees on the issue of information security then try out another high-tech method of securing the information. This inconsistency means that they do not go all the way with any one method of securing information. Therefore, they end up doing half training or full training without reinforcing the information acquired by the training, which means that the situation remains the same as before. The same applies in the use of eventuality plan that is not fully applied or is not fully tracked through. There is also the problem of methods of information security having limitations that could end up causing more harm to the information than before the methods where used. In conclusion, the issue of information security is one of the hardest problems for any organization to handle not just the VA. The best recommendation would be to continually carry out assessments that will identify potential threat to the information ad eliminate them since using technology means that it will have to be upgraded often which can be very expensive. Being alert at all, times could help reduce the level of information theft for any organization. References Department of Veterans Affairs,Strategic Plan. (n.d.). http://www.va.gov/. Retrieved January 30, 2014, from http://www.va.gov/op3/Docs/StrategicPlanning/VA_2010_2014_Strategic_Plan.pdf Health Care. (n.d.). U.S. Department of Veterans Affairs. Retrieved January 29, 2014, from http://www.va.gov INFORMATION SECURITY Veterans Affairs Needs to Resolve Long-Standing Weaknesses . (n.d.).http://www.gao.gov/. Retrieved January 30, 2014, from http://www.gao.gov/new.items/d10727t.pdf Information Security Program . (n.d.).http://www1.va.gov/. Retrieved January 30, 2014, from http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=56 Read More