Agencies should evaluate contractors for security readiness

The Federal Aviation Administration isn’t the only recent victim of a data breach. Hackers recently broke into USAJobs.com, which houses personal information on thousands of federal job seekers.

The site runs on Monster.com’s platform, and the breach, which occurred in January, included Monster, too. It provoked a debate on the wisdom of outsourcing services, especially considering the potential for identity theft using stolen job-seeker data.

Occasional data breaches will happen no matter how secure a system is, said Jonathon Giffin, an assistant computer sciences professor at the Georgia Institute of Technology.

“The government is actually behaving appropriately,” he said. “They are not experts in data security or in running a Web site that advertises jobs. Contracting that out to a company that has that expertise I think makes a lot of sense.”

But agencies can take steps to minimize the risk of lax treatment of sensitive information by an outside service provider, said Rohyt Belani, a security expert and professor at Carnegie Mellon University. Agencies should study audits of the systems that the technology providers use and investigate employee-awareness programs they have in place.

Employees who are trained to spot fraudulent e-mails – the phishing attacks that can trick employees into revealing passwords, giving the hackers a way into the system – are unlikely to fall for them, he said.

Market pressures also help provide a layer of security when government agencies outsource services, Giffin said. If a service provider has repeated security breaches, agencies are free to find another provider with better security policies.

About the Author

Doug Beizer is a staff writer for Federal Computer Week.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.