Information Assurance Vulnerability Alert - Background

Background

On February 15, 1998, the Deputy Secretary of Defense issued a classified memorandum on Information Assurance, that instructed the DISA, with the assistance of the Military Departments, to develop an alert system that ensured positive control of information assurance. According to the memorandum, the alert system should:

• Identify a system administrator to be the point of contact for each relevant network system,
• Send alert notifications to each point of contact,
• Require confirmation by each point of contact acknowledging receipt of each alert notification,
• Establish a date for the corrective action to be implemented, and enable DISA to confirm whether the correction has been implemented.

The Deputy, Secretary of Defense issued an Information Assurance Vulnerability Alert (IAVA) policy memorandum on December 30, 1999. Current events of the time demonstrated that widely known vulnerabilities exist throughout DoD networks, with the potential to severely degrade mission performance. The policy memorandum instructs the DISA to develop and maintain an IAVA database system that would ensure a positive control mechanism for system administrators to receive, acknowledge, and comply with system vulnerability alert notifications. The IAVA policy requires the Component Commands, Services, and Agencies to register and report their acknowledgement of and compliance with the IAVA database. According to the policy memorandum, the compliance data to be reported should include the number of assets affected, the number of assets in compliance, and the number of assets with waivers.