Are private intranets the answer for security?
Connecting state and local government leaders
Last September's terrorist attacks brought to light the stinging realization that agencies seldom talk or share information with one another.
Last September's terrorist attacks brought to light the stinging realization that agencies seldom talk or share information with one another.Dozens of examples were uncovered. The most infamous was that some of the Al Qaeda hijackers received federal permission to attend flight school in the United States'several months after they had died in the attacks.Better interagency data sharing could close such communication gaps. But how would sharing actually work?One paradox of networking is that users want more access to data but also more security for that data. Ensuring both at once is a complex task.Two schools of thought have emerged since Sept. 11:Intranets that exist across multiple locations generally run over separate leased lines. They are expensive to build and difficult to expand to additional users. But their limited access does have the potential for better security. As agencies attempt to share data, they'll have to choose the first path or the second'or, possibly, combine the two.GovNet, the secure government network proposed last year, would essentially be a huge intranet. By closing itself off from the Internet at large, it would offer better security to agencies that plug in their databases. But the GovNet proposal has stalled because it was short on details about interagency and intergovernmental connections.One big roadblock to the intranet path is how to set and enforce rules for participation. Complexity always increases with growth.Setting rules for access and sharing would help, but at some point the efforts to control an intranet might be equally productive if applied to security standards for government Internet connections. Richard C. Clarke, the president's cybersecurity adviser, originally promoted GovNet but has acknowledged that it could not replace the Internet for day-to-day interagency communication.The focus, in Clarke's view, should be on solving known problems, applying security patches and educating users in proper security methods.Mario Correa, director of intranet and network security policy for the Business Software Alliance, said reliance on intranets could be a reasonable short-term solution. But a sustained movement toward intranets 'presupposes that we do not have the technology to protect networks. We do,' he said. 'It's not necessary to isolate.'Correa said the problem is that not all agencies take advantage of the security features readily available to them. Reasons include lack of technical knowledge as well as procurement and management challenges.Although intranets can be set up quickly to share data in a controlled environment, that data is still at risk unless there is tight security. And if the security is supertight, it shouldn't be necessary to treat the intranet as an island unto itself. The disadvantage of a closed intranet is that vital data might not find its way off the island and into the hands of those who need it.Intranets have a place within agencies. But for broader data sharing, it might be better to keep the networks open, with these safeguards:A larger question: Is it smart to continue running multiple government databases at multiple sites, some on intranets and some not connected to networks?Local control of databases permits faster searches and updates, more flexibility for adding fields and the ability to use the data flexibly. But huge centralized databases with thousands of fields are the only way to discover certain things. Is the John Doe who's renewing a license the same Doe wanted for questioning? Or is he the John Doe who tried to obtain a passport under another name but was caught by an automated fingerprint check?In reality, creating a useful uber-database of citizen data would be nearly impossible because of the fluid nature of data and user needs. But it might be possible to streamline the data sharing via Extensible Markup Language.With XML, it doesn't matter how many fields a database has, because the centralized database doesn't exist. Data fields are simply distributed by an authority.Software engineers could establish a central 'authority' for any piece of XML data which agencies could look to at different points to check data. Such a scenario would only work in an environment of multiple connected networks with specific rules for data sharing and for overall security.Clarke has said the No. 1 priority for improving security is training, education and awareness. Post-Sept. 11, agencies need to face up to several more concerns:
Controlled environment
Shawn P. McCarthy designs products for a Web search engine provider.
The No. 1 priority for improving security is training, education and awareness, cybersecurity adviser Richard C. Clarke says.
Henrik G. DeGyor
- One: Rely on private intranets that use Internet design and protocols but exist as closed networks.
- Two: Make data available over the Internet but with heightened security and access controls, and with standards for agency participation.
Controlled environment
- Firewalls that detect and report intrusion attempts, readily available from vendors such as Network Associates Inc. of Santa Clara, Calif., and Symantec Corp. of Cupertino, Calif.
- Sophisticated virus checking at the firewall, through products from Network Associates' McAfee group, Symantec and others
- Enforced rules for employee opening of e-mail attachments
- Encryption for all connections and data transfers, through products from vendors such as F-Secure Corp. of Helsinki, Finland, and RSA Security Inc. of Redwood City, Calif.
- Authentication by synchronized, timed passwords or security certificates from vendors such as Entrust Inc. of Addison, Texas, and SafeNet Inc. of Baltimore.
- Network policies that sound alarms for activity such as using a platform to hop to another machine or network.
- Setting policies for storing and sharing data
- Setting policies for network access
- Certifying that the policies are followed.
Shawn P. McCarthy designs products for a Web search engine provider.