- The Washington Times - Monday, September 12, 2011

A state audit shows inadequate security policies has put the Virginia School for the Deaf and Blind at risk for information technology breaches, and it has uncovered accounting lapses related to a construction project.

The 173-year-old school lacks most of the information “to develop and implement an information-security program that provides assurance over data confidentiality, integrity and availability,” according to the audit.

Walter Kucharski, state auditor of public accounts, said no security breeches have occurred but the report should be a warning.

“Is anybody stealing from them today, or has anything bad happened? No,” he said. “This is basically a cautionary tale to say, “You need to think about this stuff.”

The accounting issues are related to a roughly $71 million construction effort to consolidate the Staunton-area school with the Hampton School, according to the audit.

For example, the school paid seven invoices that included travel expenses without supporting documentation and one that included overcharges for shipping fees.

In addition, school Superintendent Nancy C. Armstrong approved an architect and engineer invoice after it was paid, the audit states.

Ms. Armstrong said the errors have since been corrected.

Mr. Kucharski said the computer-security concerns are more about the school being so small, and less about institutional problems.

“If you lose one or two people, you could knock your IT department off and they wouldn’t know how to react,” he said. “And the same thing is true with the accounting department.”

Ms. Armstrong said the school is addressing that concern by implementing an Information Security Program that includes more cross-training.

“We’ve always done cross-training, internal controls,” she said. “We’ve just stepped that up.”

The school is also in the process of replacing its computers to end costly oversight from the Virginia Information Technologies Agency (VITA), which oversees IT networks for state agencies.

The school will keep administrative functions on the state network but will have to install a new system for its instructional computers.

The school’s annual bill from VITA was roughly $335,000.

Story Continues →