Feeds

Congress slams US Govt net security, privacy

Easy pickings for the malicious or the criminal

  • alert
  • submit to reddit

Top three mobile application threats

Congress' investigative arm, the General Accounting Office (GAO), is proving to be a thorn in the side of US government information administrators, having the audacity to go out and actually test federal agencies' network security and Web site privacy controls.

The vast majority of federal Web sites fail to achieve Federal Trade Commission (FTC) standards for Internet privacy, and this, ironically, includes the FTC's own Web site.

The GAO measured 65 of the government's most popular Web sites on four criteria: adequate notice of privacy practices, user choice in disclosing information, the ability to change personal information, and assurance that information is stored securely. The GAO found that only a piddling three per cent of federal sites pass on all the criteria.

"You are required to give information to the government - you have no choice. You don't have to use a commercial Web site if you feel it has a bad privacy policy. Which worries you more?" US Representative Dick Armey (Republican, Texas), who ordered the survey, asked rhetorically.

As for network security, the US government lags far behind the private sector with numerous glaring deficiencies, the GAO found.

The House Government Reform Subcommittee on Technology convened hearings Monday to consider the implications of the GAO report on network security. Committee Chairman Stephen Horn (Republican California) issued a report card on which several agencies which handle extremely sensitive data scored miserably. The Departments of Defence and the Treasury received a D plus and a D, while the Departments of Justice, Labour, and Health and Human Services all received an F.

"Our auditors have been successful, in almost every test, in readily gaining unauthorized access that would allow intruders to read, modify or delete data for whatever purpose they have in mind," the GAO report said.

"The underlying problem is poor security programme management and poor administration of available control techniques," the GAO concluded.

Many of the security problems could be addressed with basic, common-sense hygiene, like changing passwords regularly and shutting down PCs and workstations after working hours, Chairman Horn said. "That doesn't cost a thing," he observed.

"The amount of detailed information about private citizens in federal files has grown by leaps and bounds," CATO Institute Information Studies Director Solveg Singleton noted during the hearing.

"The growth of these databases makes security and the need for internal controls against unauthorised use by government employees a systemic rather than an occasional problem" which "threatens to shift the balance of power between individuals and the federal government," she observed.

The twin GAO reports are, or soon will be, available for download from the reports page on the GAO Web site. ®

The Essential Guide to IT Transformation

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Airbus promises Wi-Fi – yay – and 3D movies (meh) in new A330
If the person in front reclines their seat, this could get interesting
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Samsung threatens to cut ties with supplier over child labour allegations
Vows to uphold 'zero tolerance' policy on underage workers
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.