HHS will overhaul security
Connecting state and local government leaders
Through a new task order, the Health and Human Services Department has kicked off an effort to consolidate IT security services across its bureaus.
Through a new task order, the Health and Human Services Department has kicked off an effort to consolidate IT security services across its bureaus.The department this month signed a five-year task order with Northrop Grumman Corp. to integrate software from Internet Security Systems Inc. of Atlanta for intrusion detection and vulnerability scanning services for its 12 agencies.'Fifteen months ago, the secretary challenged us in the IT community to develop a plan for HHS with explicit goals and consolidation' plans, said Jim Seligman, CIO for the Centers for Disease Control and Prevention and one of the project managers for IT consolidation at HHS.Each bureau at HHS already had its own security program, systems and applications, Seligman said, but the department wanted a more standardized approach.'No single security prevention is going to protect you absolutely,' Seligman said. 'The core reason [for the task order] was to pull all agencies up to a minimum high-level baseline for security.'The security project is one of 10 security consolidation initiatives HHS plans to undertake, Seligman said.Initially, the department expects to spend about $2.16 million on the intrusion detection effort, but the total cost will depend on how much new hardware HHS will need to run the application on all its systems.Earlier this year, Congress earmarked $22 million in fiscal 2003 appropriations for the HHS Office of the Secretary's Security and Innovation Fund. Once that fund is approved, the security consolidation will tap into it, as well as CDC's anticipated $250 million fiscal 2003 IT budget, Seligman said.The task order was negotiated under a General Services Administration schedule contract held by Northrop Grumman.The deal has one base year and four one-year options.Northrop Grumman will integrate ISS' RealSecure Protection Platform across HHS' network servers and desktop PCs. Each HHS agency will use the new service, either to replace or to enhance existing security measures, Seligman said.The first task for Northrop Grumman is to take an inventory of the department's security software and hardware to determine how many intrusion detection sensors and vulnerability scanning software licenses HHS needs.During the second phase, the company will install the sensors, and in phase three, it will begin vulnerability scanning services.Each host-based sensor attached to a server will examine network traffic and alert administrators to activity that might represent a security threat, Seligman said.'We'll continue to refine what the sensors are triggering over time,' Seligman said.
Agency takes first steps of 5-year plan to consolidate security
Snug as a bug
'Fifteen months ago, the secretary challenged us in the IT community to develop a plan for HHS with explicit goals and consolidation' plans.
'Jim Seligman
Snug as a bug
NEXT STORY: NMCI gets a new lease on life