VA installs encryption software on 15,000 laptops
618697
As part of its ongoing efforts to ramp up security, the Department of Veterans Affairs has just finished installing encryption software on 15,000 laptops.
684167
When a Department of Veterans Affairs laptop computer was stolen in May, putting the sensitive personal information of millions of veterans at risk, VA officials sought to quell concerns by providing a toll-free number to call.
196278
Windows users will have another tool for protecting their PCs.
376700
Someday, encryption features built into a wide range of IT products -- from operating systems and messaging gateways to hard drives and storage systems -- may work in concert to offer central policy enforcement across different types of network assets and devices.Until that day arrives, however, companies embracing the tools have become dependent on standalone encryption platforms to give them distributed control and policy enforcement across their IT systems.Long known as much for their complexity and demand for hands-on care and feeding as they have been valued for their protective qualities, encryption platforms are finally finding their way into a number of large businesses.This growth in adoption has been driven by the proliferation of data protection regulations and based on the availability of products that address the hardest elements of encryption technology -- policy enforcement and key management, industry watchers contend."The performing of the encryption itself is something that generally belongs close to whatever type of data you are trying to encrypt, whether that is e-mail, network traffic, or a database, but companies are buying into technologies today that allow them to do centralized policy enforcement and key management," said Paul Stamp, analyst with Forrester Research."It's great in theory to say that all of this activity needs to happen in the infrastructure components themselves," he said. "But that's not a reality yet in terms of allowing for centralized management, so customers are turning to these platforms in the meantime."End-users agree that encryption has long been a security process they desired to implement but couldn't stomach based on issues of complexity.The arrival of more usable encryption technology over the last few years has helped eliminate some of the traditional roadblocks, according to some corporate users."From my previous experience with e-mail encryption, I had two major concerns with using the tools: Key management and any dependence on the end-user to make the systems work right," said Michael Gabriel, corporate information security officer for Career Education Corporation (CEC) a higher-education provider that operates more than 75 colleges, schools, and universities."I haven't ever seen an encryption project where management wasn't a major sticking point, that has been the history of the technology, but it seems that the vendors are finally getting it right," Gabriel said. "Compared to mapping the business process, putting the technology in place was a breeze. The only real sticking point was getting the data flow."CEC is using encryption tools made by PGP in cooperation with its data leakage prevention and e-mail filtering systems to protect sensitive information being passed among its employees.Gabriel said that PGP's embedded key management capabilities may be the most valuable aspect of the system -- a feature that simply didn't exist in the past.Other PGP users echoed those sentiments, saying that encryption tools have advanced significantly over the past several years in terms of eliminating the management headaches that have made it challenging to deploy the systems on a wider basis.At American National Insurance Company, IT leaders said that the financial services company had been considering broader use of encryption for several years before the combination of more streamlined technologies and increasing pressure in the form of compliance regulations encouraged the firm to dive in.Today, the company is using PGP tools to both obscure sensitive e-mails and provide whole disk encryption to protect data stored on its desktop and laptop computers."We'd been looking at encryption closely since at least 2005, driven largely by the laws and compliance regulations that were being passed; we needed better e-mail security because we realized after sampling that we had a problem, and knew that we wanted to better protect sensitive information on our computers," said Ken Juneau assistant vice president of Information Technology Services at ANICO."The e-mail product simply sits in the mail flow, and any outbound messages that need to be get encrypted," he said. "Key management was simply the biggest differentiator. The system has almost no overhead in terms of administration; if a key needs to be created, the system handles it, and most end-users never know that the e-mail is being encrypted, which is ideal."With the PGP whole-disk encryption system ANICO is using, Juneau said that key management and the ability to automatically create end-user credential recovery tokens have also proven as easy to use as the insurance company had hoped.Inside smaller organizations, the ability to find encryption platforms that allow for simplified installation and management has been even more acute as the realities of smaller IT staffs make it even harder to deal with any widespread usability issues, experts said.Jason Parks, information systems analyst for Northern California's Butte County Department of Information Systems, said that deploying encryption several years ago was not an option for the government body before it found tools made by vendor Voltage Security that adequately address those issues."The tools have gotten a lot better, which allowed us to move forward with our plans," Parks said."We didn't want to do a bunch of certificate management, and we wanted an easy end-user experience as well. Using the system we have in place, we don't have to give a lot of complex instructions to the users," he said. "We have a limited amount of full-time IT staff in the county, so we couldn't do this until we found something that addressed all the traditional issues with encryption management."Over the course of the two years that Butte County has been working with Voltage's e-mail encryption platform, the IT specialist said that the product has become even more refined and less intrusive to end-users."It's great to see that the encryption vendors are making progress," said Parks. "Encryption is something that a lot of smaller organizations like us need that was not a realistic proposition in the not-too-distant past."Even the vendors themselves admit that encryption tools have changed dramatically in the last several years, allowing end-users to benefit from the protection that the technology can provide without creating massive headaches related to installation and maintenance."We've been trying hard as an industry to find ways to make encryption work better for customers. The issues with this technology have never been related to the level of protection but are more about cost and complexity of the tools," said David Thompson, director of product management at Voltage. "We're trying to change the cost and usability model, and it seems like the time has come when encryption has truly become more feasible for larger numbers of organizations."Phillip Dunkelberger, chief executive of PGP, said that the key to the encryption industry's continued growth and success will be based on its ability to create tools that allow organizations to protect their data without getting in the way of end-users simply trying to do their jobs.The ability for companies like PGP to continue to make their systems easier to use and maintain will lie at the heart of that progress, he said."IT operations are being asked to do more with less. They have smaller budgets for new technologies, greater needs to use information for issues of competitive advantage, and yet they're dealing with huge issues of risks and security threats," Dunkelberger said."The security industry has done itself a disservice by selling [fear, uncertainty and doubt], but we're much better served by looking harder at trying to help lower the cost of ownership and management for these products that address data protection," he said. "How we can do this without adding complexity will be the key to our growth in the future."
575160
Barely hours after home users started securing their PCs with a key update for Windows XP, security experts have found ways around it.
521286
The company announces ASI will sell laptops with encrypted hard drives, using a chip that keeps unauthenticated users from reading data off the disk or even booting up the PC. By the Associated Press.
604602
The Department of Veterans Affairs has disclosed that information on more than half a million individuals and about 1.3 million non-VA physicians, both living and dead, is missing or might have been stolen. The information was stored on a portable hard drive that was being used by a VA employee at the department's facility in Birmingham, Ala.
438406
ASI Computer Technologies will use the automatically encrypted Momentus in a laptop.
174877
By Jon Swartz  SAN FRANCISCO -- In his swan song to an annual gathering of 15,000 computer security experts here Tuesday, Microsoft Chairman Bill Gates said the software giant has made giant strides in security.
241880
(InfoWorld) - More than half of U.S. government employees unofficially work at home on nights or weekends, raising concerns about the security of the data they're working on, according to a study released Monday. Fifty-eight percent of government employees work from home without permission, according a survey by the Telework Exchange, a group that advocates for more telecommuting opportunities. One year after the U.S. Department of Veterans Affairs announced thatÂ a laptop and hard drive were stolenÂ from an employee's home, many U.S. agencies still lack plans for dealing with teleworking employees, the survey suggests. Fifty-four percent of these unofficial teleworkers carry files home, according to the survey. The VA hardware, later recovered, contained the personal information of 26.5 million military veterans and family members. Even after the breach, 13 percent of U.S. agencies do not put encryption on new laptops issued, compared to 11 percent that did not include encryption before the VA breach, according to the survey. Less than half of agencies updated their encryption and protection technologies, and less than half provided security training to employees after the VA breach, the survey said. Sixteen percent of agencies did not react at all, the survey said. "It's kind of alarming ... that people still are not doing everything they can do to protect their mobile devices," said Joshua Wolfe, director of federal sales for Utimaco Safeware, a cybersecurity vendor that underwrote the survey. "You've got a lot of unofficial teleworkers out there who are taking information out of the agency and working from home on unsecured computers." Teleworking itself isn't the problem, Wolfe said. U.S. government workers who have permission to telework generally have more security training and more security tools on their work computers than those unofficial teleworkers. For example, 94 percent of survey respondents who are official teleworkers said they have antivirus software on their work computers. Only 75 percent of respondents who don't officially telework said they had antivirus software on their work computers. Sixty-seven percent of teleworkers said they had encryption on their work computers, while only 60 percent of non-teleworkers said they did. The major problem is that U.S. agencies don't seem to be keeping up with the trend toward mobile computing, Wolfe said. "Over the past year, more and more people have been given mobile devices," he said. "At the same time, [they] have not been given the tools from a policy perspective." Utimaco and the Telework Exchange recommended that U.S. agencies determine how many of their employees are unofficially teleworking. All employees, not just teleworkers, should receive cybersecurity training, and agencies should use encryption and other data security protections on all desktops and laptops, they recommended. The Telework Exchange conducted the survey of 258 U.S. agency employees in May. The survey has a margin of error of 6.1 percent.
424496
Using its strengths in virtual machine technology, VMWare on Monday unwrapped new beta software for the desktop that allows administrators to more securely deploy and mange work environments outside the corporate network.
322292
Company releases a key-management product aimed at helping companies manage encrypted systems more efficiently.
537829
New packages promote promise of improved PC security.
519426
The Department of Defense took an estimated 1,500 computers offline after a security breach in the Office of the Secretary of Defense.
537202
The U.S. Department of Veterans Affairs hasn't finished implementing most of the IT security improvements recommended by federal auditors after a laptop containing sensitive data was stolen from an employee's home in May 2006.
205960
Microsoft Corp. yesterday released an unusually large number of software security updates to fix flaws in its products, some of which could be exploited to remotely take over computers running the Windows operating system.
678764
PC Tools' Malware Research Center reports a 57  percent increase in keylogging activity affecting both the consumer and  enterprise users in Europe and the United States.