Essential information only

The surest way for agencies to avoid losing personal information would be to not have it in the first place. But since that's not possible, the next best step is to keep only what's necessary.That's part of the idea behind the Office of Management and Budget's order that agencies get better control over personal information held in their paper and electronic files and develop policies for responding when those controls are breached.The prime directive in OMB Memo 07-16 for reducing the likelihood that such information is stolen is to 'limit its collection,' said Tim Grance, manager of systems and network security at the National Institute of Standards and Technology. There is no need to manage or protect what you do not have.The memo, issued May 22, is a response to heightened concerns about identity theft and the large amount of sensitive information held in government systems, some of it unnecessarily.Although agency policies must spell out conditions for notification of potential victims of data theft, the memo stops short of actually requiring such notification.Agencies have until Sept. 22 to complete and implement their policies, and some already are well on their way toward compliance.The Federal Trade Commission had its policy in place by the end of June, chief privacy officer Marc Groman said during a recent panel discussion on the OMB memo.It is a broad policy that establishes a team to respond to data breaches and defines a 13-step plan for evaluating a breach's severity. This rapid response is due in part to the fact that FTC is a small agency, Groman said. But work had begun on the policy even before the guidelines were issued.The current requirements had been foreshadowed by a similar memo in 2006, Groman said. 'It wasn't news to us in May of 2007.'The Homeland Security Department has its policy drafted and is reviewing it, said chief privacy officer Hugo Teufel III. The policy is called the Personally Identifiable Information Guidelines, and 'this PIIG should fly by the end of August,' he said.Work on the DHS policy also began before the OMB memo was issued, Teufel said. It was spurred by the loss in April of a drive containing 100,000 personnel records from the Transportation Security Administration. Despite the security breach that the loss represented, Teufel called the department's response to it 'a model of how things should be done.' The department began codifying that response in a policy memorandum shortly after the breach occurred.The requirement that agencies develop formal policies for dealing with breaches of personal information was recommended in the April report of the president's Identity Theft Task Force, established last year. The new guidelines expand on recommendations issued by OMB in its June 2006 memo, 'Protection of Sensitive Agency Information,' which spurred FTC's policy. In addition to reminding agencies that they already should be following existing NIST guidance for protecting information, the 2006 memo recommended encryption, two-factor authentication, automatic time-outs and logs of data extractions (see chart).The May 2007 memo focuses specifically on what it calls personally identifiable information, which contains enough data ' such as names, Social Security number and addresses ' to allow an individual to be identified and create a risk of identity theft if exposed.The current memo recaps many of the requirements in last year's memo in addition to NIST guidelines for data protection, but it adds additional requirements, including a policy for notification of potential victims when there has been a breach.Although OMB requires that all data breaches be reported to US-CERT within one hour of discovery, the new memo does not require notification of potential victims when personally identifiable information is exposed, acknowledging that notification is 'not always necessary or desired.' It does not set thresholds for when notification should occur.Each agency must develop its own thresholds and policy for notification, educate its employees about requirements to report breaches and losses, and specify disciplinary action when that policy is violated.Agencies also are required to identify and review their current holdings of personally identifiable information and reduce the use of Social Security numbers where possible.A discussion of the new OMB requirements was hosted in Washington this month by Homeland Defense Journal.Although participants from DHS, FTC, NIST and the Justice Department agreed that limiting collection of data and the use of Social Security numbers is key to improving protections against identity theft, 'it is going to be a while' before SSNs and other data are scrubbed from files, said Justice chief information technology security technologist Mischel Kwon. In the meantime, 'education is our interim solution.'Education is an integral part of the FTC policy. All employees must understand their responsibility to report incidents before the breach notification team can work, Groman said.The policy, which spells out disciplinary actions for violations, is included in the FTC administrative manual and in the agency's mandatory computer training program. Each employee must sign a PIIG policy compliance form.Grance said NIST is responding to the OMB memo in its usual way: 'Writing publications.' A series of publications will be released on protecting personally identifiable information and other sensitive data.'In a few weeks, we'll come out with something on virtual private networks using' Secure Sockets Layer for remote access, he said.Other publications will cover storage and encryption technology for users and enterprises, remote access security, incident handling and operating system security.Implementing a meaningful breach response policy will require common sense as well as technology, Grance said. Responsibility will be broad-based and extend well beyond the traditional confines of IT and security shops.'All the groups that never had to talk to each other now need to talk to each other and live with each other,' he said.