The Department of Veterans Affairs Inspector General has found that while the agencyâs Office of Information Technology enforced proper mobile security measures, there were certain issues in the fortification ofÂ its network infrastructure.
The IG report, released on Tuesday, states thatÂ OIT didnât address vulnerabilities in configuration management and failed to implement blacklisting procedures for mobile applications that could lead to malicious attacks and loss of data to unsafe cloud environments.
According to the audit teamâs findings, OIT doesnât implement configuration management tools to handle automated updates for mobile devices and applications. The Government Accountability Officeâs Federal Information System Controls Audit Manual states that such controls âprovide reasonable assurance that changes to information system resources are authorized and systems are configured and operated securely and as intended.â
The OIT director of mobile technology and endpoint security engineering noted that the office didn’t implement blacklistingÂ due to the amount of workload associated with the vetting process.
OIT handles over 50,000 VA devices through a centralized, enterprise-wide Mobile Device Management system.