Feeds

Congress slams US Govt net security, privacy

Easy pickings for the malicious or the criminal

  • alert
  • submit to reddit

Security for virtualized datacentres

Congress' investigative arm, the General Accounting Office (GAO), is proving to be a thorn in the side of US government information administrators, having the audacity to go out and actually test federal agencies' network security and Web site privacy controls.

The vast majority of federal Web sites fail to achieve Federal Trade Commission (FTC) standards for Internet privacy, and this, ironically, includes the FTC's own Web site.

The GAO measured 65 of the government's most popular Web sites on four criteria: adequate notice of privacy practices, user choice in disclosing information, the ability to change personal information, and assurance that information is stored securely. The GAO found that only a piddling three per cent of federal sites pass on all the criteria.

"You are required to give information to the government - you have no choice. You don't have to use a commercial Web site if you feel it has a bad privacy policy. Which worries you more?" US Representative Dick Armey (Republican, Texas), who ordered the survey, asked rhetorically.

As for network security, the US government lags far behind the private sector with numerous glaring deficiencies, the GAO found.

The House Government Reform Subcommittee on Technology convened hearings Monday to consider the implications of the GAO report on network security. Committee Chairman Stephen Horn (Republican California) issued a report card on which several agencies which handle extremely sensitive data scored miserably. The Departments of Defence and the Treasury received a D plus and a D, while the Departments of Justice, Labour, and Health and Human Services all received an F.

"Our auditors have been successful, in almost every test, in readily gaining unauthorized access that would allow intruders to read, modify or delete data for whatever purpose they have in mind," the GAO report said.

"The underlying problem is poor security programme management and poor administration of available control techniques," the GAO concluded.

Many of the security problems could be addressed with basic, common-sense hygiene, like changing passwords regularly and shutting down PCs and workstations after working hours, Chairman Horn said. "That doesn't cost a thing," he observed.

"The amount of detailed information about private citizens in federal files has grown by leaps and bounds," CATO Institute Information Studies Director Solveg Singleton noted during the hearing.

"The growth of these databases makes security and the need for internal controls against unauthorised use by government employees a systemic rather than an occasional problem" which "threatens to shift the balance of power between individuals and the federal government," she observed.

The twin GAO reports are, or soon will be, available for download from the reports page on the GAO Web site. ®

New hybrid storage solutions

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.