As data breaches pile up, OMB cracks down

The flood of recent data breaches appears to be the product of a perfect storm of inadequate security controls, enforcement and training. As a result, the Office of Management and Budget has announced a deadline for agencies to implement data security safeguards, and Congress is watching to ensure that agencies comply.Agencies are likely experiencing more security breaches, but they're also disclosing them more often, security experts say.The continuous flow of bad security news is sending a message to agency heads, said Marc Noble, acting computer security officer at the Federal Communications Commission.'With all the security problems happening and being talked about in the news, management sees it as a problem, and they understand they have to move on it,' he said. 'Once they focus on the problem, then we can focus on it too.'The spate of recent security breaches started with the theft of sensitive information on up to 26.5 million veterans, reservists and active military personnel from a Veterans Affairs Department employee. The notebook PC containing that data was recovered last week.Data breaches have also occurred at the Agriculture Department, the IRS, Social Security Administration, Navy and other agencies.Momentum is building for agencies to strengthen their security controls significantly'and quickly. Heads of departments that have lost data, such as VA secretary Jim Nicholson, bear the brunt of a lot of unwanted attention, said Shannon Kellogg, director of government and industry affairs at RSA Security Inc. of Bedford, Mass.Now OMB has strongly recommended that agencies comply, by early August, with best practices and implement additional security safeguards for remote access and encryption of data on laptops. The recommendations emphasize measures that should already be in place, Clay Johnson, OMB's deputy director for management, said in a memo last week to agency executives.This was OMB's second memo in a month reminding agencies of their responsibilities about safeguarding data.Once the August deadline arrives, it's up to OMB to determine which agencies haven't followed the guidance.'OMB has a stick if they want to wield it. That's where it's important for Congress to have an oversight role, like [House Government Reform Committee] chairman [Tom] Davis, to track this closely,' Kellogg said.OMB's leverage comes through the budgeting process, said Paul Kurtz, executive director of the Cyber Security Industry Alliance and a former Homeland Security Department official.For example, OMB has the authority to withhold budget approval unless an agency makes corrections, he said.'This kind of guidance that they have to implement within 45 days is a strong recommendation to take action,' Kurtz said.Under the Federal Information Security Management Act, OMB requires that agencies identify and provide risk-based data security safeguards but does not stipulate individual requirements. Davis (R-Va.), who tracks agencies' security efforts, said he hopes that OMB's action will effect change.'If not, perhaps Congress will have to step in and mandate specific security requirements,' Davis said in a statement.'It's fair to say he doesn't think we can afford to wait too long to see better results,' said Robert White, a committee spokesman.FCC, for one, is looking at the recommendations as requirements, Noble said. 'The FCC is taking security more seriously these days,' Noble said.FCC already has implemented OMB's recommendations for two-factor authentication, time-out and re-authentication after a period of inactivity, and some logging of data. But the commission will have to buy an encryption package to provide for data on notebook PCs, Noble said.Justice views OMB's memo as providing another opportunity to evaluate security controls and find gaps that need more emphasis, said Dennis Heretick, the department's chief security officer.'It's not really new requirements because we already are assessing ourselves,' he said.The increasing numbers of data breaches shouldn't be surprising, Kurtz said.'For far too long information security has been buried within federal agencies, and senior officials and cabinet-level officers have not been interested in the issue,' he said.A lot of agencies still are struggling with deploying and enforcing best practices, RSA's Kellogg said.'You can put best practices in place but if they are not enforced or someone just decides to break policy, then the processes break down,' he said.Kurtz said the challenge is enforcement, accountability and authority.'You have to have the authority to enforce policy, and for those who do not exercise their authority and enforce policies, there must be accountability,' Kurtz said.Agency CIOs, CISOs and security professionals are trying to do their jobs, but they don't have authority and they don't answer to a cabinet-level official, he said.'Almost universally, they do not have the authority within the organization to compel people to follow their guidance, or do not have the authority to get the resources to secure systems the way they think it should be done,' Kurtz said.In light of the numerous data breaches, it's appropriate that Congress consider fortifying FISMA, he said. FISMA has accomplished much in beginning to account for agency information systems.'But as in financial accounting, there are ways to finesse the system that you're addressing the problem, but you may be having problems you're not addressing,' he said.He cautioned on requiring more reports in the absence of giving CIOs enforcement authority. When CIOs are empowered and answer to the agency head, the reports become more meaningful and accountability can follow, Kurtz said.'When an agency files a report [now], there is no teeth behind it and no authority behind those who report it,' he said.