eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Government and public-sector agencies must be able to provide secure access to employees, citizens and suppliers around the world. This presents a monumental challenge considering todays range of Internet security threats. Increasingly, attacks in both the private and public sectors are driven by financial gain—hackers are no longer motivated by notoriety. With mountains of personal and private data stored, government agencies are a target for attacks. They have literally everything to lose and must understand emerging threats and how to protect against them.
Information leakage is a serious emerging threat for government agencies. These attacks, which occur both accidentally and maliciously, are on the rise in the public sector. A noteworthy example is the Department of Veterans Affairs, which lost the personal information of 26 million veterans when an employees laptop was stolen. The consequences of personal information in the wrong hands could be devastating.
From classified defense information to Social Security numbers, agencies must prevent employees from accidentally or maliciously sending data to a nontrusted or unknown location or to an unauthorized internal recipient. Increasingly, agencies are implementing information leak prevention technologies to thwart data loss. Hackers will seek to improve concealment methods of stealing data using encryption with malicious code to bypass these technologies.
The Web will continue to be the No. 1 infection vector for malicious code designed to steal information, which is evolving at a rapid pace in both numbers and attack sophistication.
Underground cyber-criminals are becoming better organized and are running a better economy, including buying and selling of hacker tool kits and zero-day vulnerabilities that can be exploited. With financial gain on the table, the market for zero-day attack code is becoming more competitive, resulting in more attacks and more sophisticated attacks on both the client and server side.
Protecting your agency against these threats is all about being proactive. Traditional approaches to security that focus on anti-virus and intrusion prevention are identifying attacks only after theyve compromised the network. While the basics—anti-virus and firewalls, for example—are still a critical part of any government security strategy, they are not equipped to deal with todays quickly evolving threats. Agencies need to implement technology that finds, blocks and protects them from Web-based threats before they compromise systems.
Agencies also should look for technology that acts as a “digital data guardian” to help control how sensitive data can leave the organization and under what circumstances. Information leak prevention solutions can help control where users go, how they get there, and what information they can send or use.
Government agencies also have a responsibility to follow state and federal regulations that relate to data security. For example, as of June 2006, 31 states had data protection laws in place, such as Californias SB1386, which applies to both government agencies and private companies and requires notification to California residents when that data has been or may have been accessed without authorization. Recently, additional bills, such as the federal Data Accountability and Trust Act, have been introduced to protect consumers. That act requires agencies to uphold reasonable security policies and procedures to protect computerized data containing personal information and to provide for nationwide notice in the event of a breach.
There is also the Federal Information Security Management Act. FISMA outlines standards for information security requirements as well as guidelines for determining the effectiveness of security systems. Its designed to help government agencies understand security vulnerabilities and implement systems that mitigate risk at a low cost. While regulations such as FISMA are instrumental in providing a consistent approach to security, its important to stay ahead of the curve with a proactive approach.
Check out eWEEK.coms for the latest news, views and analysis of technologys impact on government and politics.