Editorial: The real security challenge

Last month, the federal government was caught up in yet another security incident, this time involving a stolen laptop PC belonging to the National Institutes of Health. The laptop contained research data, including participants’ names, birth dates, hospital record numbers and medical reports.

Government officials could argue that the loss was less serious than it could have been: Only about 2,500 records were involved; the data had little, if any, commercial use; and the records offered identity thieves little usable information. The laptop did not contain Social Security numbers, addresses, phone numbers or financial information. One could also argue that the amount and portability of government-held information make such incidents inevitable.

Those arguments might win a legal case. Unfortunately, in the court of public opinion, the government has lost again. This incident is particularly painful because it seems to show that agencies didn’t learn from the Veterans Affairs Department’s experience when one of its laptop PCs was stolen in 2006.
And there is an added twist: The laptop contained medical data on Rep. Joe Barton (R-Texas).

However, our intention isn’t to chastise NIH but rather encourage agencies to learn some important lessons. The incident reminds us how portable data has become. Large amounts of information can be transported effortlessly and lost just as easily.

Government officials said data on the NIH laptop should have been encrypted, which underscores the need to involve frontline employees in security efforts. Apparently, NIH researchers were reluctant to encrypt the data on their laptop PCs because doing so slowed them down and made it difficult to share that data with other authorized users. We don’t know if that is true, but it serves as a reminder that security measures must be relatively easy to use.

Last month, we highlighted a case in which another VA laptop was lost, but because the machine’s data was encrypted, it remained safe. However, VA researchers still balk at the department’s security requirements.

Federal leaders face a difficult task in ensuring that users have secure access to the information they need to perform their jobs. That challenge will only grow.
As is so often the case, there are no easy answers.


chart

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.