The question What information was stolen from JPL during the Raspberry Pi hack? refers to an event in recent news (e.g. Engadget's A rogue Raspberry Pi helped hackers access NASA JPL systems) and references NASA's Office of Inspector General June 2019 report Cybersecurity Management and Oversight a the Jet Propulsion Laboratory which states on page 17 in the section titled Incomplete and Inaccurate System Component Inventory:
Moreover, system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators responsible for managing the 13 systems in our sample maintain a separate inventory spreadsheet of their systems from which they periodically update the information manually in the ITSDB. One system administrator told us he does not regularly enter new devices into the ITSDB as required because the database’s updating function sometimes does not work and he later forgets to enter the asset information. Consequently, assets can be added to the network without being properly identified and vetted by security officials. The April 2018 cyberattack exploited this particular weakness when the hacker accessed the JPL network by targeting a Raspberry Pi computer that was not authorized to be attached to the JPL network. 32 The device should not have been permitted on the JPL network without the JPL OCIO’s review and approval.
Question: I'm asking for a better understanding of the explanation given related to the Raspberry Pi incident. Is the failure to keep an updated list of authorized devices a central cause or primary contributing factor to the breach, or is the list a peripheral issue and the network should have been secure against connection of any Raspberry Pi, authorized or not.
This answer starts to outline the seriousness of the breach.