Crashing and burning —

NASA’s outsourced computer people are even worse than you might expect

Agency's CIO holds off signing the "authority to operate" for systems and tools.

NASA is unhappy with its HPE services contract.
Enlarge / NASA is unhappy with its HPE services contract.
NASA

As part of a plan to help NASA "modernize" its desktop and laptop computers, the space agency signed a $2.5 billion (~£1.9 billion) services contract with HP Enterprise Services in 2011. According to HP (now HPE), part of the Agency Consolidated End-User Service (ACES) program the computing company would "modernize NASA’s entire end-user infrastructure by delivering a full range of personal computing services and devices to more than 60,000 users." HPE also said the program would "allow (NASA) employees to more easily collaborate in a secure computing environment."

The services contract, alas, hasn't gone quite as well as one might have hoped. This week Federal News Radio reported that HPE is doing such a poor job that NASA's chief information officer, Renee Wynn, could no longer accept the security risks associated with the contract. Wynn, therefore, did not sign off on the authority to operate (ATO) for systems and tools.

A NASA spokeswoman confirmed the ATO expired on July 24. She said Wynn signed a “conditional” ATO for the systems under ACES, but internal NASA sources said the authorization is just for the management tools and not for the desktops, laptops and other end user devices.

“NASA continues to work with HPE to remediate vulnerabilities,” the spokeswoman said. “As required by NASA policy, system owners must accomplish this remediation within a specified period of time. For those vulnerabilities that cannot be fully remediated within the established time frame, a Plan of Actions and Milestones (POAM) must be developed, approved, and tracked to closure.”

Letting an ATO expire on a major agency network is unheard of in government.

Practically, this probably won't change much on the ground for NASA's computing systems immediately. But operating without an ATO indicates that the agency is accepting (or perhaps "accepting") a large amount of operational IT security risks, instead of trying to understand and mitigate them.

According to an anonymous NASA infosec officer quoted by Federal News Radio, more than 38,000 ACES-supported computers across all NASA centers have more than 378,000 unpatched vulnerabilities in aggregate. It's speculated that the refusal to sign off on the ATO is designed to bring the deficiencies of the HP contract to the attention of NASA's federal watchdogs, including the Office of Management and Budget, Congress and the US Government Accountability Office.

Channel Ars Technica