Study: U.S. government still lacking data protection
241880
(InfoWorld) - More than half of U.S. government employees unofficially work at home on nights or weekends, raising concerns about the security of the data they're working on, according to a study released Monday. Fifty-eight percent of government employees work from home without permission, according a survey by the Telework Exchange, a group that advocates for more telecommuting opportunities. One year after the U.S. Department of Veterans Affairs announced thatÂ a laptop and hard drive were stolenÂ from an employee's home, many U.S. agencies still lack plans for dealing with teleworking employees, the survey suggests. Fifty-four percent of these unofficial teleworkers carry files home, according to the survey. The VA hardware, later recovered, contained the personal information of 26.5 million military veterans and family members. Even after the breach, 13 percent of U.S. agencies do not put encryption on new laptops issued, compared to 11 percent that did not include encryption before the VA breach, according to the survey. Less than half of agencies updated their encryption and protection technologies, and less than half provided security training to employees after the VA breach, the survey said. Sixteen percent of agencies did not react at all, the survey said. "It's kind of alarming ... that people still are not doing everything they can do to protect their mobile devices," said Joshua Wolfe, director of federal sales for Utimaco Safeware, a cybersecurity vendor that underwrote the survey. "You've got a lot of unofficial teleworkers out there who are taking information out of the agency and working from home on unsecured computers." Teleworking itself isn't the problem, Wolfe said. U.S. government workers who have permission to telework generally have more security training and more security tools on their work computers than those unofficial teleworkers. For example, 94 percent of survey respondents who are official teleworkers said they have antivirus software on their work computers. Only 75 percent of respondents who don't officially telework said they had antivirus software on their work computers. Sixty-seven percent of teleworkers said they had encryption on their work computers, while only 60 percent of non-teleworkers said they did. The major problem is that U.S. agencies don't seem to be keeping up with the trend toward mobile computing, Wolfe said. "Over the past year, more and more people have been given mobile devices," he said. "At the same time, [they] have not been given the tools from a policy perspective." Utimaco and the Telework Exchange recommended that U.S. agencies determine how many of their employees are unofficially teleworking. All employees, not just teleworkers, should receive cybersecurity training, and agencies should use encryption and other data security protections on all desktops and laptops, they recommended. The Telework Exchange conducted the survey of 258 U.S. agency employees in May. The survey has a margin of error of 6.1 percent.
63439
The FBI failed to report accurately how many people it snooped on using anti-terror measures, officials said a government audit revealed today. Demands for banks and phone companies to hand over people's private information without telling them may also have gone beyond what is allowed by the Patriot Act, officials with access to the report told CNN.
468227
Working group generates little real agreement on how or even whether to implement proposed privacy reforms.
597653
Government secrecy has increased sharply in the past few years &#151; keeping Americans in the dark about information they should be able to access, says a report released Thursday by a coalition of watchdog groups.
433751
The Bush administration has no clear strategy to protect the privacy of patients as it promotes the use of electronic medical records, investigators say.
530105
Not only is the U.S. government keeping too many secrets, it's spending too much money to do it. That's the conclusion of a government watchdog group, which estimates more than $6.5 billion was spent last year keeping data under wraps. By Noah Shachtman.
596425
Businesses may be spending millions on expensive security technologies aimed at thwarting data leakage and compliance violations, but many companies are still failing to sufficiently address access controls for protected information and IT systems.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
182346
Personal information about Americans is stolen or lost from some government or private computer almost daily, but congressional auditors can link only a few identity thefts to the breaches.
729347
The U.S. Department of Veterans Affairs has made progress on data security since last May's laptop theft, but still needs to address a variety of shortcomings, government auditors say.
698751
High-tech companies are working with the U.S. government to develop a secure data-sharing system.
679082
Experts are concerned that data may not being properly protected by the IRS and that a massive data loss by the agency, similar to the one last month by the U.K.'s Revenue and Customs office, could disrupt the nation's banking system.
676751
(InfoWorld) - The U.S. Commerce Department reported that 1,137 laptops have been lost or stolen since 2001, with 249 of them containing some degree of personal data. The department couldn't determine whose data may have been on the machines, of which 672 belonged to the Census Bureau. It wasn't aware of any data having being used improperly, it said Thursday. The findings are from a Commerce Department review covering 15 agencies that use a total of 30,000 laptops. It comes as businesses and governments try to tighten their control over mobile devices after several high-profile incidents concerning theÂ loss of sensitive data. The Census Bureau's laptops -- used for collecting census data in the field -- rarely contain data on more than 100 households, and the data can't be accessed by the surveyors, many of whom are temporary, hourly employees. the department said. However, the Census Bureau also lost 15 handheld computers used to gather survey data. As a result, the department is contacting 558 households. The risk of the data being misused was "extremely low," it said, since the data is encrypted and two passwords are required for access. The National Oceanic and Atmospheric Administration, which falls under the Commerce Department, lost 325 laptops, three of which had personal data. One of the laptops was stolen after a fire at one of its buildings in Seattle, Washington. The machine contained addresses, birth dates and Social Security numbers for 146 employees, the department said. Commerce Secretary Carlos M. Gutierrez said the agency plans toÂ strengthen accountability standards, encrypt data on all department laptops and implement two-factor authentication. U.S. government agencies have been stung by hardware losses in recent months. In May, aÂ laptop and external hard drive was stolenÂ from the home of a U.S. Department of Veterans Affairs employee containingÂ data on 26.5 million veteransÂ and active-duty military personnel. The laptop was recovered, and two teenagers were arrested in June. Â
163835
Homeland Security ditches a 2003 data-mining program created to monitor immigration, customs, border protection and biological defense after investigators find it was tested with data about real people without meeting privacy requirements. DHS says the Analysis, Dissemination, Visualization, Insight and Semantic Enhancement program was too time-consuming to use.
620585
The Census Bureau collects the most personal information about Americans, from how much money they earn and where they spend it to how they live and die. It's all confidential &#151; as long as no one steals it.
426045
'Identity reconstruction' still possible Large databases do not adequately protect sensitive personal information, according to a statistics professor in the US, who says that individuals can still be identified despite attempts to anonymise them.â¦