http://www.fcw.com/article97159-12-19-06-Web 

By Wade-Hahn Chan
Dec. 19, 2006

Information security is the Commerce Department's no. 1 challenge in 
this fiscal year, according to its inspector general.

In its semiannual report to Congress for the six months ending Sept. 30, 
the IG cited the department's poor track record with regard to 
protecting the privacy of personal data and its slow progress on 
certifying the security of its critical systems.

The privacy concerns stem from a late September study that found the 
department had lost 1,137 laptop computers and other mobile devices 
since 2001, 249 of which contained personally identifiable information 
(PII).

Under guidelines that the Office of Management and Budget issued, 
agencies must take several steps to protect personal data. To start, 
they should encrypt all sensitive data stored on mobile devices. They 
also must incorporate two kinds of authentication -- such as passwords 
and fingerprints -- to control remote access to systems with sensitive 
data. Finally, they should set up their systems to disconnect users who 
have been logged on for too long without any activity, and they should 
log all activity on those systems.

It was unclear whether Commerce had followed those guidelines, the IG 
reported.

We found that in most cases bureaus could not demonstrate that the 
necessary steps have been taken to ensure that PII is adequately 
safeguarded, the report stated. None of the system documentation 
reviewed indicated that PII was stored or processed, a step needed to 
determine the required safeguards.

The IG also criticized the department for the mixed results of its 
efforts to certify and accredit the security of important systems. 
Commerce officials appear to have made some progress, completing the 
process for 22 of its 28 systems by August 2006 - an increase from only 
five a year earlier.

In evaluating the certification and accreditation documentation, the IG 
found that only a third of the systems fully complied with the security 
standards that the National Institute of Standards and Technology set, 
and nine of the remaining systems had serious deficiencies.


_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn