Information Security Professionals Struggle with Rise of Facebook and Other Web 2.0 Tools

The predictable tension between information security officers and early adopters in state and local IT is brewing again. This time it pits proponents of social networking sites against security officials who see fast-growing tools, like Facebook and Twitter, as conduits for malware and data breaches.

Supporters say public agencies must learn how to use social networks effectively to reach younger citizens and support an incoming government work force that considers e-mail obsolete. But security officials - accustomed to being an afterthought in the rush to deploy the latest must-have applications - worry that cool new Web 2.0 tools will expose government networks and sensitive information to dangerous cyber-threats.

Video: California CISO Mark Weatherford discusses social networks and other security challenges.

Social networks are merely the latest technical evolution to give security officials heartburn, said John Pescatore, a vice president of Gartner.

"It wasn't that long ago when government agencies weren't allowing wireless [local area networks] LANs in either. Now they support wireless LANs. It wasn't that long before that when they were doing war dialing to find Internet connections and turn them off too," Pescatore said.

The security community's knee-jerk reaction against many new technologies is understandable, he said. Early adopters tend to deploy first and worry about security and privacy later - creating serious challenges for those charged with protecting government information and computing assets. Still, Pescatore contends that security officials would be more effective if they said "yes" from the beginning, but with a caveat.

"Security people need to say, 'If we're going to do this, here's what we need to put into place to manage the risk,' instead of building a case for saying no," he said.

That's the approach being taken in several states, including California, where state Chief Information Security Officer (CISO) Mark Weatherford is developing an employee policy for using social networking sites.

"I am going to do everything I can do to help this thing be successful and not be the roadblock that stops progress," he said. "We've had concerns every time some new technology pops up over the years. We addressed them, we worked through them and came out better in the long run."

Photo: Mark Weatherford, Chief Information Security Officer, California

Social Networking Sieves

The gravest concern regarding usage of social networking sites by government employees appears to be that it increases opportunities for data leakage. One common complaint is that security offices already have difficulty policing e-mail without adding social networking sites that aren't even part of the government's network. Observers see added potential for both malicious and accidental data breaches.

For example, Pescatore offered the hypothetical scenario of a state park ranger using Facebook for updating the availability of open campsites. Such a project could be useful to citizens who want to avoid a long drive only to find the park full.

Imagine that to save time the ranger simply posted the spreadsheet showing which campsites were taken and which remained open. What if he didn't notice that a second tab of the spreadsheet had the credit card numbers campers used to hold their spots? That's just one of countless potential scenarios.

Lawsuits could result from one innocent mistake. At the same time, Pescatore points out that solutions do exist. Products designed to catch various types of information before they leave a network are on the market. Governments could program data-loss prevention programs to filter for credit card numbers, Social Security numbers and any other data they needed to protect.

California's strategy for using social networking