IT security plans getting personal

Agencies haven't been ignoring security in recent years, but while they focused on protecting the highest-risk areas, many left personal data in peril.Federal officials said agencies did not pay enough attention to such important controls as encrypting data on mobile devices and logging all computer-readable data extracts from databases holding personal information.And this lack of control over personnel data was a major contributor to the rash of data losses and breaches over the last three months, federal experts said.'There are so many things to be done. We've been attacking chunks of them. We have our hands full,' said Vance Hitch, Justice Department CIO and chairman of the federal CIO Council's executive committee on cybersecurity and privacy.The recent spike in reported data breaches prompted the Office of Management and Budget in June to require that agencies enforce existing data security provisions and put new ones in place. The deadline was last week.OMB guidance acts as an accelerant for agencies to get their data security in place, said newly minted Education CIO Bill Vajda.The breaches also spotlight one aspect of the IT security universe and how vulnerable agencies can be with remote access and personally identifiable information, Hitch said'For comparison purposes, maybe we've addressed what we considered the high-risk items. Now this will make us focus more on those two things as higher risk than what we thought before,' he said.Agencies must install controls and other IT security safeguards under the Federal Information Security Management Act and guidelines recommended by the National Institute of Standards and Technology, including Federal Information Processing Standard 200 and Special Publication 853, he said.OMB added safeguards in the June memo: Agencies must encrypt data on mobile devices, use two-factor authentication for remote access, require re-authentication after 30 minutes of inactivity and log all computer-readable data extracts from databases holding personal information. OMB gave agencies until Aug. 7 to have these controls in place.Agencies are expected to review their information systems and ensure that they are properly protecting sensitive data, an OMB spokeswoman said.'We continue to work with inspectors general and chief information officers to ensure agencies are compliant with existing administration policies and IT standards, and that all improvements necessary to secure sensitive information are made,' the OMB spokeswoman said about the deadline.Department inspectors general will analyze how well their agencies comply with the guidelines and report to OMB in September, Hitch said.'I think it will become clearer what the federal government needs to do,' he saidFor agencies, the data breaches triggered renewed efforts to implement data security controls and highlighted their importance, said Dennis Heretick, Justice chief information security officer.Education was conducting its annual IT security refresher course for employees when the reported incidents took place, Vajda saidThe breaches let people know how serious security is, said Education chief information security officer Jerry Davis.'It reinforced all the conversations, training and me standing on a soapbox in front of our senior officers all the way down to our most junior career staff. ... IT security is a shared responsibility,' Davis said.Education also introduced new training modules specifically on privacy to re-emphasize the importance of protecting personal information, he added.With the urgency to comply with OMB's data security requirements, Education accelerated some milestones for previously planned IT security investments, Vajda said.'The incidents gave us a little more leverage in our investment review process, where we could move up milestones, get broader support from some people. ... It gave us more momentum to do it in a timely way,' Vajda said.For example, OMB's requirement for two-factor authentication for data protection during remote access was already part of Education's investment strategy for complying by October with Homeland Security Presidential Directive-12. So Education accelerated that milestone.The department also is speeding up a milestone for encrypting data archived on backup tapes already stored in secure repositories, Davis said. So if that media is lost, the data is not compromised.Some of OMB's data security requirements are in place, such as double-checking gap analyses on 30-minute time-out sessions for remote access to department systems. Others will take longer, despite the urgency in the OMB memos, Vajda said.'Most of my colleagues would echo: We want to make sure we solve the problem and do it right,' he said.At Justice and many other agencies, IT security policies and procedures are already in place, Hitch said. But agencies need to clarify specific areas of the policy at a level of detail everybody understands.'It's not a change in direction in policy. ... It's getting people enough specifics so that they better understand how to implement it,' Hitch said, adding that it will include more training.Technology, such as for logging all computer-readable data extracts, may assist agencies, Hitch said.'But technology is not a silver bullet that you can implement tomorrow,' he said.It involves the entire IT architecture, all agency databases and all the data, Hitch said.'Even if the technology is promising and we want to go ahead with it, it could take years, and you'd have to implement it selectively on a risk-based approach,' he said.Compliance with the newer OMB data security policies on mobile devices is a matter of stricter enforcement and identifying weaknesses, Heretick said.The CIO Council helps agencies with the establishment of IT security through opportunities for cross-department sharing of best practices in seminars and other CIO gatherings, Hitch said. The emerging IT security Line of Business will break down IT security into specialty areas, creating shared-services centers.'Agencies [whose programs] are designated as a Line of Business for that sliver of IT security would serve as a resource to other federal agencies,' Hitch said.The Government Accountability Office also will evaluate how agencies comply with IT security.'We have received and accepted congressional requests to look at federal policies and practices for protecting personal information,' said Gregory Wilshusen, director of GAO's information security issues.GAO, however, has not started this work and does not yet have an expected completion date. n