Government Technology

Information Security Professionals Struggle with Rise of Facebook and Other Web 2.0 Tools



August 23, 2009 By

The predictable tension between information security officers and early adopters in state and local IT is brewing again. This time it pits proponents of social networking sites against security officials who see fast-growing tools, like Facebook and Twitter, as conduits for malware and data breaches.

Supporters say public agencies must learn how to use social networks effectively to reach younger citizens and support an incoming government work force that considers e-mail obsolete. But security officials - accustomed to being an afterthought in the rush to deploy the latest must-have applications - worry that cool new Web 2.0 tools will expose government networks and sensitive information to dangerous cyber-threats.

'; var html5Player = 'false' ; var androidPlayer = 'false'; var br = getBrowserType(); if(br == 'Android' ) {thePlayer = androidPlayer;} else if(br =='iPhone' || br == 'iPad') {thePlayer = html5Player;} else {thePlayer = flashPlayer; } document.write(thePlayer);

Video: California CISO Mark Weatherford discusses social networks and other security challenges.

Social networks are merely the latest technical evolution to give security officials heartburn, said John Pescatore, a vice president of Gartner.

"It wasn't that long ago when government agencies weren't allowing wireless [local area networks] LANs in either. Now they support wireless LANs. It wasn't that long before that when they were doing war dialing to find Internet connections and turn them off too," Pescatore said.

The security community's knee-jerk reaction against many new technologies is understandable, he said. Early adopters tend to deploy first and worry about security and privacy later - creating serious challenges for those charged with protecting government information and computing assets. Still, Pescatore contends that security officials would be more effective if they said "yes" from the beginning, but with a caveat.

"Security people need to say, 'If we're going to do this, here's what we need to put into place to manage the risk,' instead of building a case for saying no," he said.

That's the approach being taken in several states, including California, where state Chief Information Security Officer (CISO) Mark Weatherford is developing an employee policy for using social networking sites.

"I am going to do everything I can do to help this thing be successful and not be the roadblock that stops progress," he said. "We've had concerns every time some new technology pops up over the years. We addressed them, we worked through them and came out better in the long run."

Photo: Mark Weatherford, Chief Information Security Officer, California

Social Networking Sieves

The gravest concern regarding usage of social networking sites by government employees appears to be that it increases opportunities for data leakage. One common complaint is that security offices already have difficulty policing e-mail without adding social networking sites that aren't even part of the government's network. Observers see added potential for both malicious and accidental data breaches.

For example, Pescatore offered the hypothetical scenario of a state park ranger using Facebook for updating the availability of open campsites. Such a project could be useful to citizens who want to avoid a long drive only to find the park full.

Imagine that to save time the ranger simply posted the spreadsheet showing which campsites were taken and which remained open. What if he didn't notice that a second tab of the spreadsheet had the credit card numbers campers used to hold their spots? That's just one of countless potential scenarios.

Lawsuits could result from one innocent mistake. At the same time, Pescatore points out that solutions do exist. Products designed to catch various types of information before they leave a network are on the market. Governments could program data-loss prevention programs to filter for credit card numbers, Social Security numbers and any other data they needed to protect.

California's strategy for using social networking


| More

Comments

Add Your Comment

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.

In Our Library

White Papers | Exclusives Reports | Webinar Archives | Best Practices and Case Studies
Maintain Your IT Budget with Consistent Compliance Practices
Between the demands of meeting federal IT compliance mandates, increasing cybersecurity threats, and ever-shrinking budgets, it’s not uncommon for routine maintenance tasks to slip among state and local government IT departments. If it’s been months, or even only days, since you have maintained your systems, your agency may not be prepared for a compliance audit—and that could have severe financial consequences. Regardless of your mission, consistent systems keep your data secure, your age
Best Practice Guide for Cloud and As-A-Service Procurements
While technology service options for government continue to evolve, procurement processes and policies have remained firmly rooted in practices that are no longer effective. This guide, built upon the collaborative work of state and local government and industry executives, outlines and explains the changes needed for more flexible and agile procurement processes.
Fresh Ideas In Online Security for Public Safety Organizations
Lesley Carhart, Senior Information Security Specialist at Motorola Solutions, knows that online and computer security are more challenging than ever. Personal smartphones, removable devices like USB storage drives, and social media have a significant impact on security. In “Fresh Ideas in Online Security for Public Safely Organizations,” Lesley provides recommendations to improve your online security against threats from social networks, removable devices, weak passwords and digital photos.
View All

Featured Papers


Government Technology
Public CIO
Emergency Management
Digital Communities