http://www.fcw.com/online/news/151741-1.html
By Jason Miller
FCW.com
February 25, 2008
Two high-ranking senators want to know when agencies will fully
implement the Bush administrations requirements to protect personally
identifiable data.
Sens. Susan Collins (R-Maine), ranking member of the Homeland Security
and Governmental Affairs Committee, and Norm Coleman (R-Minn.), ranking
member of the Homeland Security and Governmental Affairs Committees
Permanent Subcommittee on Investigations, sent letters to 24 Cabinet
agencies Feb. 22 requesting a written timeline for when they will meet
all four requirements laid out by the Office of Management and Budget in
a June 2006 memo.
In the letter, the senators told the agency secretary which of the five
requirements the department needs to implement. The lawmakers also asked
for status updates or compliance timelines for five other OMB memos
dating as far back as 2005 that deal with data security, including
designating senior officials in charge of privacy.
As the federal government obtains and processes information about
individuals in increasingly diverse ways, it is critically important
that it ensure the privacy rights of individuals are respected and that
personal information is properly secured and protected, the senators
wrote.
The letter comes on the same day the Government Accountability Office
found agency progress in meeting these June 2006 security requirements
inconsistent.
Auditors said most agencies 22 of them -- have developed policies
requiring personally identifiable information to be encrypted on mobile
computers and devices, and 15 agencies have polices that require the
hardware to time-out after more than 30 minutes of inactivity.
But GAO also found that only 11 agencies have established policies to
log computer-readable data extracts and erase data after 90 days, while
14 implemented two-factor authentication where one of the factors is
provided by a device separate from the computer gaining access.
Auditors said many agencies are still researching the technology to use
to log computer-readable data extracts and erase data.
GAO also found that only four agencies had policies requiring the use of
the National Institute of Standards and Technologys security checklist
in Special Publication 800-53. In addition, 20 agencies had written
policies that require encryption software to comply with NIST Federal
Information Processing Standard 140-2.
Gaps in their policies and procedures reduce agencies ability to protect
personally identifiable information from improper disclosure, auditors
wrote. We reiterate, however, as we have in the past, that although
having specific policies and procedures in place is an important factor
in helping agencies to secure their information systems and to protect
personally identifiable information, proper implementation of these
policies and procedures remains crucial.
Coleman and Collins expressed dismay about the reports findings.
The findings released in this report are very troubling indicating that
agency after agency has failed to make securing citizens personal
information a high priority, Coleman said in a statement. The clock is
ticking and we need to know when the agencies are going to have the
protections in place to stop the numerous data breaches we have seen
over the past few years. The bottom line is the federal government has a
responsibility to ensure the personal information it collects from its
citizens is properly secured and protected.
Collins added that agencies need to act more quickly to protect
sensitive data.
OMB officials agreed with the report and said they added these
requirements as part of the agency scores under the e-government portion
of the Presidents Management Agenda score card, GAO said.
OMB is working with the agencies and monitoring their progress in
addressing the recommendations of the President's Identity Theft Task
Force, said Karen Evans, OMBs administrator for e-government and
information technology, in a statement. It's important to ensure that
agencies have the proper security controls in place to minimize and
prevent risks to the public's information.
?The GAO report has shown improvements have been made, but we are
woefully short of where we should be 18 months after the OMB directives,
said Rep. Tom Davis (R-Va.), ranking member of the Oversight and
Government Reform Committee. Im particularly concerned about the pace of
efforts to encrypt personal data kept on laptops and other mobile
devices. Citizens most sensitive information should not be we walking
around waiting to be lost or stolen. Too many laptops and hard drives
still go missing, and too many peoples critical digital identities are
put at risk when that happens.
___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
Comments