ICO: Whitehall has improved data security
Gov congratulated for starting what it should be doing already
What you need to know about cloud backup
The information commissioner says that government has improved both its data protection and its disclosure of such work.
Christopher Graham was commenting on a Cabinet Office report which sets out work since the Data Handling Review of June 2008, which set out measures for departments to improve data security.
He was positive about the changes to ensure the secure use of personal data in government since then and said the report "marks an important step in bringing greater openness and transparency to the ways in which government handles our personal data".
The document, Protecting Information in Government, was published on 14 January 2010 and highlights work carried out across government to improving data handling. This includes:
- The introduction of enhanced data security training for more than 450,000 public servants
- The establishment of a network of more than 150 senior information risk owners at board level within organisations and some 9,000 people who are responsible for ensuring that data is handled responsibly at a working level
- Encryption of mobile devices including laptops and removable media, with more than 100,000 devices encrypted to date
- Penetration testing of ICT systems to check their vulnerability to electronic attack and other threats, with more than 650 tests conducted to date
- More than 270 privacy impact assessments carried out on new projects which involve handling personal data
The report also highlights new powers awarded to the Information Commissioner's Office to carry out assessment notices: spot checks on government departments, conducted without prior notice. The government has formalised this arrangement by including provisions in the Coroners and Justice Act 2009.
"In the past it had become too easy to think that a tiny memory stick was not something that needed to be particularly protected," said cabinet secretary Sir Gus O'Donnell.
"While we continue to do more with less to meet the challenges of the economic downturn, including bringing greater efficiencies and savings, the task of improving information security will always be a continuing process with no room for complacency."
The report says that an update of the National Information Assurance Strategy this year will address the next steps required and set a strategic direction.
This article was originally published at Kable.
Kable's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.
COMMENTS
It's not just govt...
... that are reactive rather than proactive. Business from the very small to the very large are equally guilty - think TJX, think HSBC, and they're just the high-profile ones. Often it's not until you have a breach that you know something has a vulnerability. You can point at penetration testing, vulnerability assessments, data security and the likes, and they are all very good things to point at, but infosec isn't something you 'do', it's something you 'are'. It's a constant cat-and-mouse game between those who seek to protect information and those who seek to obtain information. Absolutely some of the more blunderous problems should never have happened, but the fact that things have improved considerably should be applauded.
Mine's the one with the CISSP 10 Domains of InfoSec Guidebook in the (extremely large) pocket
they're getting better at *not* loosing gour data
So they just *have* to collect more of it to begin with.
270 privacy impact assesments. How many *new* systems doe this government need?
They haven't done much
They've just shifted the liability away from Westminster.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
