Editorial: The real security challenge

Last month, the federal government was caught up in yet another security incident, this time involving a stolen laptop PC belonging to the National Institutes of Health. The laptop contained research data, including participants’ names, birth dates, hospital record numbers and medical reports.

Government officials could argue that the loss was less serious than it could have been: Only about 2,500 records were involved; the data had little, if any, commercial use; and the records offered identity thieves little usable information. The laptop did not contain Social Security numbers, addresses, phone numbers or financial information. One could also argue that the amount and portability of government-held information make such incidents inevitable.

Those arguments might win a legal case. Unfortunately, in the court of public opinion, the government has lost again. This incident is particularly painful because it seems to show that agencies didn’t learn from the Veterans Affairs Department’s experience when one of its laptop PCs was stolen in 2006.
And there is an added twist: The laptop contained medical data on Rep. Joe Barton (R-Texas).

However, our intention isn’t to chastise NIH but rather encourage agencies to learn some important lessons. The incident reminds us how portable data has become. Large amounts of information can be transported effortlessly and lost just as easily.

Government officials said data on the NIH laptop should have been encrypted, which underscores the need to involve frontline employees in security efforts. Apparently, NIH researchers were reluctant to encrypt the data on their laptop PCs because doing so slowed them down and made it difficult to share that data with other authorized users. We don’t know if that is true, but it serves as a reminder that security measures must be relatively easy to use.

Last month, we highlighted a case in which another VA laptop was lost, but because the machine’s data was encrypted, it remained safe. However, VA researchers still balk at the department’s security requirements.

Federal leaders face a difficult task in ensuring that users have secure access to the information they need to perform their jobs. That challenge will only grow.
As is so often the case, there are no easy answers.


chart

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.