The flood of recent data breaches appears to be the product of a perfect storm of inadequate security controls, enforcement and training. As a result, the Office of Management and Budget has announced a deadline for agencies to implement data security safeguards, and Congress is watching to ensure that agencies comply.
Agencies are likely experiencing more security breaches, but they’re also disclosing them more often, security experts say.
The continuous flow of bad security news is sending a message to agency heads, said Marc Noble, acting computer security officer at the Federal Communications Commission.
“With all the security problems happening and being talked about in the news, management sees it as a problem, and they understand they have to move on it,” he said. “Once they focus on the problem, then we can focus on it too.”
The spate of recent security breaches started with the theft of sensitive information on up to 26.5 million veterans, reservists and active military personnel from a Veterans Affairs Department employee. The notebook PC containing that data was recovered last week.
Data breaches have also occurred at the Agriculture Department, the IRS, Social Security Administration, Navy and other agencies.
Momentum is building for agencies to strengthen their security controls significantly—and quickly. Heads of departments that have lost data, such as VA secretary Jim Nicholson, bear the brunt of a lot of unwanted attention, said Shannon Kellogg, director of government and industry affairs at RSA Security Inc. of Bedford, Mass.
Now OMB has strongly recommended that agencies comply, by early August, with best practices and implement additional security safeguards for remote access and encryption of data on laptops. The recommendations emphasize measures that should already be in place, Clay Johnson, OMB’s deputy director for management, said in a memo last week to agency executives.
This was OMB’s second memo in a month reminding agencies of their responsibilities about safeguarding data.
Digg
De.licio.us
Slashdot
Technorati
