IfG.CC - The Institute for eGovernment

In a new paper, “Common Risks Impeding the Adequate Protection of Government Information,” OMB and DHS discuss common problems in areas such as training, contracting and records management.

“We are all frustrated at the pace at which the government has been reacting to this,” said Rep. Tom Davis (R-Va.), who has taken a lead in IT issues in Congress.

These functions accounted for more than one-half of the total IT investment by state and local governments in 2004 and will be the focus of the spending increases, the firm said.

When the auditor/controller-recorder’s office of San Bernardino County, Calif., tried to improve its information technology security through requiring complex passwords with upper- and lower-case letters and special characters, the plan backfired, IT chief Patrick Honny recalled.

“We had situations, especially after a weekend or a holiday, when our help-desk requests went through the roof,” Honny said.

To avoid forgetting the long passwords, some users were writing them down, a basic security no-no.

he Security Industry Association (SIA) has released a set of recommendations for adding a biometric component to the federal E-Verify program.

E-Verify allows employers to use Social Security numbers to confirm that job applicants are legal residents of the United States and can lawfully work for them. The program, though, is subject to significant error rates and is unable to detect fraud and identity theft. SIA, on Sept. 16, released a statement asserting that the use of biometrics in the program “can reduce these error rates, increase privacy and enhance identity assurance.”

The Enterprise Strategy Group (ESG) unveiled research late last month divulging how vulnerable the businesses behind the U.S. supply chain and resources network — goods and services forming the backbone of the country’s well-being and economy — are to cyber-attack. ESG found that in the past two years most of them have been breached, many more than once. Only a few employ cyber-security best practices for the supply chain.

These are eye-opening findings, according to Jon Oltsik, ESG principal analyst and the author of the report, Assessing Cyber Supply Chain Security Vulnerabilities within the U.S. Critical Infrastructure.

The Office of Management and Budget and the Chief Information Officers Council will kick off a new task force called the Security and Identity Management Committee. The group aims to help agencies comply with the Federal Information Security Management Act, Homeland Security Presidential Directive 12, Federal Desktop Core Configuration and Trusted Internet Connection, to name a few.

The problem is that the Social Security number is very vulnerable to theft and misuse, even though it is the foundation of almost every U.S. citizen's identity. A paper card certainly does nothing to help protect the Social Security number printed on it.

The Homeland Security Information Network-Secret (HSIN-Secret) is an “immediate, inexpensive and temporary approach to reach state and local homeland security and law enforcement sites that can receive secret-level information,” Matthew Broderick, director of the Homeland Security Operations Center, said in testimony today to the House Homeland Security Subcommittee on Intelligence, Information Sharing and Terrorism Risk Assessment.

Ein Hacker auf einer Parkbank könnte sich in dutzende Netzwerke der US-Regierung einloggen, berichtet ein Washington-Korrespondent des australischen Infodienstes AustralianIT. Der Journalist bezieht sich dabei auf einen neuen Report, den er in die Finger bekam. Dem Papier zufolge arbeitet die Regierung auf Basis alter lückenhafter Sicherheitsstandards.

Intranets have grown to be thousands and even millions of pages of content. Given their size and scope, they present challenges that are similar to those common in external sites. There has also been a tendency for intranets to become dumping grounds for obsolete and irrelevant content. The result can be unforeseen privacy and security risks, wasted employee productivity and unnecessary cost burdens.

The White House on Wednesday issued an update of the Obama administration's ongoing cybersecurity work, detailing some of the steps being taken in an effort to secure the nation's networks against cyber attacks and in the process offering some new insight into the administration's future plans.

The progress report, issued immediately after a meeting held by White House cybersecurity coordinator Howard Schmidt with agency secretaries, cybersecurity experts, and industry, notes that the cybersecurity directorate of the White House national security staff is currently in the midst of developing an updated national cybersecurity strategy based on the 12-piece Comprehensive National Cybersecurity Initiative.

A memo (PDF format) released this week by the Office of Management and Budget lays out new requirements for agencies to set up automated threat-monitoring feeds that automatically gather data from security management tools -- enabling admins to gather real-time data on attacks and other dangers.

The vision of the group is: “To improve the trustworthiness and security of online transactions by facilitating the establishment of interoperable trust frameworks and implementation of improved authentication technology and processes for all online transaction participants, across federal, civil and private sectors.”

As Wichita health care providers move toward paperless work environments, the security of private data is paramount to successful systems.

Yet electronic health records are surprisingly easy to hack into and are vulnerable to exploitation, according to a study by the eHealth Vulnerability Reporting Program.

Die Initiative des Cabinet Office sieht vor, spezielle Sicherheitstestprofile für Open-Source-Systeme zu entwickeln, die auf SELinux und Xen aufbauen. Die entsprechenden Einzelheiten zu diesem Projekt wurden in einer Debatte des House of the Lords, dem britischen Oberhaus, bekannt. Das Ziel des amtlichen Projekts ist die Schaffung vertrauenswürdiger Plattformen für Webservices und ferngewartete Systeme, die in allen britischen Regierungsbehörden bedenkenlos eingesetzt werden können.