Editorial: The real security challenge

Last month, the federal government was caught up in yet another security incident, this time involving a stolen laptop PC belonging to the National Institutes of Health. The laptop contained research data, including participants’ names, birth dates, hospital record numbers and medical reports.

Government officials could argue that the loss was less serious than it could have been: Only about 2,500 records were involved; the data had little, if any, commercial use; and the records offered identity thieves little usable information. The laptop did not contain Social Security numbers, addresses, phone numbers or financial information. One could also argue that the amount and portability of government-held information make such incidents inevitable.

Those arguments might win a legal case. Unfortunately, in the court of public opinion, the government has lost again. This incident is particularly painful because it seems to show that agencies didn’t learn from the Veterans Affairs Department’s experience when one of its laptop PCs was stolen in 2006.
And there is an added twist: The laptop contained medical data on Rep. Joe Barton (R-Texas).

However, our intention isn’t to chastise NIH but rather encourage agencies to learn some important lessons. The incident reminds us how portable data has become. Large amounts of information can be transported effortlessly and lost just as easily.

Government officials said data on the NIH laptop should have been encrypted, which underscores the need to involve frontline employees in security efforts. Apparently, NIH researchers were reluctant to encrypt the data on their laptop PCs because doing so slowed them down and made it difficult to share that data with other authorized users. We don’t know if that is true, but it serves as a reminder that security measures must be relatively easy to use.

Last month, we highlighted a case in which another VA laptop was lost, but because the machine’s data was encrypted, it remained safe. However, VA researchers still balk at the department’s security requirements.

Federal leaders face a difficult task in ensuring that users have secure access to the information they need to perform their jobs. That challenge will only grow.
As is so often the case, there are no easy answers.


chart

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.