Government Technology

    Digital Communities
    Industry Members

  • Click sponsor logos for whitepapers, case studies, and best practices.
  • McAfee

Information Security Professionals Struggle with Rise of Facebook and Other Web 2.0 Tools



August 23, 2009 By

The predictable tension between information security officers and early adopters in state and local IT is brewing again. This time it pits proponents of social networking sites against security officials who see fast-growing tools, like Facebook and Twitter, as conduits for malware and data breaches.

Supporters say public agencies must learn how to use social networks effectively to reach younger citizens and support an incoming government work force that considers e-mail obsolete. But security officials - accustomed to being an afterthought in the rush to deploy the latest must-have applications - worry that cool new Web 2.0 tools will expose government networks and sensitive information to dangerous cyber-threats.

'; var html5Player = 'false' ; var androidPlayer = 'false'; var br = getBrowserType(); if(br == 'Android' ) {thePlayer = androidPlayer;} else if(br =='iPhone' || br == 'iPad') {thePlayer = html5Player;} else {thePlayer = flashPlayer; } document.write(thePlayer);

Video: California CISO Mark Weatherford discusses social networks and other security challenges.

Social networks are merely the latest technical evolution to give security officials heartburn, said John Pescatore, a vice president of Gartner.

"It wasn't that long ago when government agencies weren't allowing wireless [local area networks] LANs in either. Now they support wireless LANs. It wasn't that long before that when they were doing war dialing to find Internet connections and turn them off too," Pescatore said.

The security community's knee-jerk reaction against many new technologies is understandable, he said. Early adopters tend to deploy first and worry about security and privacy later - creating serious challenges for those charged with protecting government information and computing assets. Still, Pescatore contends that security officials would be more effective if they said "yes" from the beginning, but with a caveat.

"Security people need to say, 'If we're going to do this, here's what we need to put into place to manage the risk,' instead of building a case for saying no," he said.

That's the approach being taken in several states, including California, where state Chief Information Security Officer (CISO) Mark Weatherford is developing an employee policy for using social networking sites.

"I am going to do everything I can do to help this thing be successful and not be the roadblock that stops progress," he said. "We've had concerns every time some new technology pops up over the years. We addressed them, we worked through them and came out better in the long run."

Photo: Mark Weatherford, Chief Information Security Officer, California

Social Networking Sieves

The gravest concern regarding usage of social networking sites by government employees appears to be that it increases opportunities for data leakage. One common complaint is that security offices already have difficulty policing e-mail without adding social networking sites that aren't even part of the government's network. Observers see added potential for both malicious and accidental data breaches.

For example, Pescatore offered the hypothetical scenario of a state park ranger using Facebook for updating the availability of open campsites. Such a project could be useful to citizens who want to avoid a long drive only to find the park full.

Imagine that to save time the ranger simply posted the spreadsheet showing which campsites were taken and which remained open. What if he didn't notice that a second tab of the spreadsheet had the credit card numbers campers used to hold their spots? That's just one of countless potential scenarios.

Lawsuits could result from one innocent mistake. At the same time, Pescatore points out that solutions do exist. Products designed to catch various types of information before they leave a network are on the market. Governments could program data-loss prevention programs to filter for credit card numbers, Social Security numbers and any other data they needed to protect.

California's strategy for using social networking


| More

Comments

Add Your Comment

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.

In Our Library

White Papers | Exclusives Reports | Webinar Archives | Best Practices and Case Studies
Digital Cities & Counties Survey: Best Practices Quick Reference Guide
This Best Practices Quick Reference Guide is a compilation of examples from the 2013 Digital Cities and Counties Surveys showcasing the innovative ways local governments are using technological tools to respond to the needs of their communities. It is our hope that by calling attention to just a few examples from cities and counties of all sizes, we will encourage further collaboration and spark additional creativity in local government service delivery.
Wireless Reporting Takes Pain (& Wait) out of Voting
In Michigan and Minnesota counties, wireless voting via the AT&T network has brought speed, efficiency and accuracy to elections - another illustration of how mobility and machine-to-machine (M2M) technology help governments to bring superior services and communication to constituents.
Why Would a City Proclaim Their Data “Open by Default?”
The City of Palo Alto, California, a 2013 Center for Digital Government Digital City Survey winner, has officially proclaimed “open” to be the default setting for all city data. Are they courageous or crazy?
View All



Government Technology
Public CIO
Emergency Management
Digital Communities