Early in July, Aerojet Rocketdyne agreed to a $9M settlement in a whistleblower lawsuit. The aerospace and defense company was sued on behalf of the state of California by Brian Markus, a former senior director of cybersecurity, compliance, and controls hired in 2014.
Markus alleged that the company promised a $10-$15M budget, a staff of up to 10 employees, and up to 25 contractors to improve the company’s security system. However, they only allocated a $3.8M budget, a staff of two, and seven contractors.
Aerojet Rocketdyne worked with U.S. federal government agencies, including the Department of Defense and NASA. According to Markus, the company wasn’t compliant with government cybersecurity regulations and shared misleading information about its cybersecurity practices.
In 2015, one year after being hired, Markus refused to verify that the company’s program complied with government regulations. He reported the incident to Aerojet Rocketdyne’s ethics hotline, and his employment was terminated within the year.
In the complaint that was filed with the court, Markus claimed the defendants were “understaffed and under budgeted to provide the level of cyber security that was required by the federal acquisition regulations for contractors granted access to UCTI [unclassified controlled technical information] or SBU [sensitive but unclassified information] belonging to the federal government.”
Under the False Claims Act, Markus was able to file the lawsuit on behalf of the U.S....
Read Full Story:
https://securityboulevard.com/2022/09/blowing-the-whistle-for-cybersecurity-c...