Federal Breaches Spark Security Review Push
GAO, administration officials call for look into data collection processes
Computerworld - The massive data breach disclosed last month by the U.S. Department of Veterans Affairs has triggered sweeping reviews of information security policies at the VA and at several other government agencies that recently suffered smaller data losses.
And last week, officials at the Government Accountability Office and the White House Office of Management and Budget (OMB) said that federal agencies as a whole need to review their processes for collecting and storing data and controlling access to it.
The string of data breaches highlights the fact that agencies have to take a more strategic approach to guarding personal information, said Linda Koontz, director of information management issues at the GAO.
"We are believers in the notion of privacy impact assessments -- of looking at the implications of the information you are collecting and how to protect that," Koontz said in an interview after she testified at a hearing held last Wednesday by the House Committee on Veterans' Affairs.
The recent breach disclosures prompted the OMB to direct all agency heads to describe the specific steps they are taking to implement the requirements of the Federal Information Security Management Act in their annual reports on their compliance with FISMA.
"Agencies have a responsibility to ensure that they are FISMA-compliant and that their employees are trained to work with tough security measures," an OMB spokeswoman said. She added that the OMB has set "sound standards and policies" based on FISMA's mandates and is working with agencies "to make sure practices match these policies."
A Stronger FISMA
Rep. Tom Davis (R-Va.), chairman of the House Committee on Government Reform, last week promised to introduce legislation seeking to strengthen breach-notification requirements at agencies. His vow followed a belated disclosure by the Department of Energy that the Social Security numbers and other personal data of about 1,500 employees and contract workers were compromised by a hacker last September.
In addition to the VA and the Energy Department, the Social Security Administration and the Internal Revenue Service recently acknowledged that they had been hit by data breaches.
Davis has said the recent incidents highlight the need to strengthen FISMA's requirements. At a VA-related hearing that the Government Reform Committee held on June 8, he called for the addition of unspecified penalties and incentives to foster better information-security practices.
During the same hearing, VA Secretary R. James Nicholson expanded on some of the measures the agency is taking to prevent further breaches. Among them are a complete ban on using personally owned computers and laptops to log into the agency's networks, and an indefinite suspension of the practice of permitting VA employees to download claims files and work on them from home. Nicholson said he has also ordered a complete recall of all agency-issued laptops for a comprehensive security review by the end of this month.
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!