Agencies should evaluate contractors for security readiness

The Federal Aviation Administration isn’t the only recent victim of a data breach. Hackers recently broke into USAJobs.com, which houses personal information on thousands of federal job seekers.

The site runs on Monster.com’s platform, and the breach, which occurred in January, included Monster, too. It provoked a debate on the wisdom of outsourcing services, especially considering the potential for identity theft using stolen job-seeker data.

Occasional data breaches will happen no matter how secure a system is, said Jonathon Giffin, an assistant computer sciences professor at the Georgia Institute of Technology.

“The government is actually behaving appropriately,” he said. “They are not experts in data security or in running a Web site that advertises jobs. Contracting that out to a company that has that expertise I think makes a lot of sense.”

But agencies can take steps to minimize the risk of lax treatment of sensitive information by an outside service provider, said Rohyt Belani, a security expert and professor at Carnegie Mellon University. Agencies should study audits of the systems that the technology providers use and investigate employee-awareness programs they have in place.

Employees who are trained to spot fraudulent e-mails – the phishing attacks that can trick employees into revealing passwords, giving the hackers a way into the system – are unlikely to fall for them, he said.

Market pressures also help provide a layer of security when government agencies outsource services, Giffin said. If a service provider has repeated security breaches, agencies are free to find another provider with better security policies.

About the Author

Doug Beizer is a staff writer for Federal Computer Week.

The Fed 100

Read the profiles of all this year's winners.

Featured

  • Shutterstock image (by wk1003mike): cloud system fracture.

    Does the IRS have a cloud strategy?

    Congress and watchdog agencies have dinged the IRS for lacking an enterprise cloud strategy seven years after it became the official policy of the U.S. government.

  • Shutterstock image: illuminated connections between devices.

    Who won what in EIS

    The General Services Administration posted detailed data on how the $50 billion Enterprise Infrastructure Solutions contract might be divvied up.

  • Wikimedia Image: U.S. Cyber Command logo.

    Trump elevates CyberCom to combatant command status

    The White House announced a long-planned move to elevate Cyber Command to the status of a full combatant command.

  • Photo credit: John Roman Images / Shutterstock.com

    Verizon plans FirstNet rival

    Verizon says it will carve a dedicated network out of its extensive national 4G LTE network for first responders, in competition with FirstNet.

  • AI concept art

    Can AI tools replace feds?

    The Heritage Foundation is recommending that hundreds of thousands of federal jobs be replaced by automation as part of a larger government reorganization strategy.

  • DOD Common Access Cards

    DOD pushes toward CAC replacement

    Defense officials hope the Common Access Card's days are numbered as they continue to test new identity management solutions.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group