A secure strategy for online services

TWO OF THE NATION’S largest counties are coming to grips with one of the primary challenges of online government: providing Web-based services while managing sensitive information securely.

Los Angeles County in California and its neighbor to the southwest, Orange County, are adopting product suites from single vendors to help manage the security of large enterprise networks and prevent data leakage.

Los Angeles County, the nation’s most populous county with 10.5 million people and 88 cities, is in the second phase of a data protection initiative aimed at securing data residing on or moving through almost 90,000 desktop and 11,000 laptop PCs.

It is not a trivial task, said county Chief Information Security Officer Robert Pittman. The county has a population larger than 43 states’, he said, with an annual budget of $22 billion, with an $800 million information technology budget for 38 departments in 70 locations.

The initiative began about two years ago with the encryption of all laptop hard drives. In the second phase, the county is focusing on monitoring and controlling the use of removable storage devices on laptops and computers with a suite of tools from Safend, of Israel. Agencies are in the early stages of implementing Safend Auditor to do device discovery, Protector to enforce policy on removable devices, and Reporter for reporting.

Orange County, the third largest U.S. county with a population of 3 million, is upgrading an outdated information security infrastructure, standardizing on a suite of products from Secure Computing.

Tony Lucich, the county’s CISO and enterprise architect, said the existing, heterogeneous systems had been in place for years and needed to be replaced when he arrived at the county four years ago.

“The systems were fine if Web traffic was 15 percent of your bandwidth, but they didn’t meet current needs,” he said. Threats had also evolved. “About 70 percent of the sites you go to today are infected,” and spam is a much bigger problem.

To simplify the architecture and address current threats, the county picked the Secure Firewall to protect its perimeter, Secure Mail to protect and enforce policies on email, and Secure Web to enforce Web policies and filter incoming and outgoing traffic. Each of these products incorporates TrustedSource reputation-based filtering to block or flag traffic from questionable sources.

The counties arrived at standardized solutions through different routes. L.A. County chose the Safend suite as a single solution, entering into a master purchase agreement with the Vantage Group, a consulting firm and reseller.

Orange County selected the Secure Computing suite one product at a time after a series of pilot programs and trials by different agencies.

“It was very difficult and competitive,” Lucich said, with a separate competition for each element. “We couldn’t just use something because we’d dealt with the company before. They came back with a single vendor that met all of their needs.”

The first issue addressed in L.A. County’s security initiative was the potentially sensitive information held on its 11,000 laptop PCs. The first challenge was identifying exactly what constitutes sensitive or personally identifiable information, which varies with different agencies’ regulations.

“You can break it into four areas,” Pittman said:

• Health and mental health data falls under the federal Health Insurance Portability and Accountability Act.
• Data for Children and Family Wellbeing and other social services are regulated by state welfare codes.
• Law enforcement and legal information are controlled by the local district attorneys, public defenders offices and police agencies.
• General government information in business, taxes and other services is covered by state and federal privacy laws.

The second phase of the data security initiative addressed the potential problems that could come from portable devices — CDs, thumb drives, external drives, and every other kind of storage unit that can be linked to a computer through a USB port or wireless links such as FireWire, Wi-Fi, Bluetooth or infrared.

Keeping tabs

The Safend Data Leakage Prevention suite helps control ports and devices and monitors which devices are in use.

The Auditor product maps all media and devices connected to networked computers using a temporary client agent sent via the server. It collects data from the computer’s registry and then is deleted. Protector uses a client agent to control ports and removable media in real time through policy enforcement.

One server can manage as many as 30,000 endpoints, said Edy Almer, Safend vice president of product management. “We don’t have a scaling limitation,” he said.

Unlike the countywide mandate for full-disk encryption, each agency is pursuing its own policy in implementing removable media controls, based in part on individual regulatory requirements.

In Orange County, the challenge was replacing the outdated IT environment with an integrated system for providing services to agencies. “We wanted to build a federated organization for the county, with a simplified infrastructure,” Lucich said.

The process of defining needs and identifying an architecture required a lot of pizzas and sodas. “If you provide food, they will come,” he said. Lucich hosted a series of speakers from agencies and vendors, looking for areas of common need in which a common infrastructure could be applied.

Orange County chose Secure Computing suite through a series of projects in which agencies partnered to test solutions. The Secure Firewall, Web and Mail products emerged separately as winners, and they were not originally acquired as a single suite. However, ending up with a suite from a single vendor has improved efficiency of information security operations, Lucich said.

The tools are centrally located in the county’s data center, but administration of Web filtering, e-mail filtering and encryption are shared with each agency. Firewalls are handled separately. Each agency has its own set of rules in the firewalls, but management is done only by the data center’s security team.

The result has been a simpler security infrastructure. “We used to have 57 firewalls,” Lucich said. “We’re down to eight now, with much simpler administration.”

The next phase of L.A. County’s security initiative will address data leakage, focusing on how confidential information is handled and transferred, and accounting for all data that must be retained and made available under e-discovery requirements.

That probably won’t begin before the third quarter of 2009. In the meantime, Pittman is happy with the improvements to the county’s data security.

“I have very little time to sleep,” he said, “but I do sleep well when I do."