White House sets deadline for security breach-notification plans
US public sector ordered to raise its security game
By Jaikumar Vijayan, Computerworld | Published 16:00, 29 May 07
As part of the new privacy measures, agencies are now required to review all of the personal data currently in their possession and make sure the data is "accurate, relevant, timely and complete," and to reduce that data to the minimum needed for official purposes.
Agencies will also need to review their use of Social Security numbers and identify areas where such information is unnecessary, or where alternate information could be used.
Also, agencies are required by mid-September to come up with a plan for eliminating the Social Security numbers within 18 months.
On the security front, Johnson's directive asks federal agencies to encrypt all data on mobile computers and devices carrying agency data. It also asks them to control remote access to agency networks via two-factor authentication and to use a "timeout" function for remote devices, requiring user re-authentication. In addition, the memorandum calls for database access monitoring to make sure that all access to private data is logged.
Security incident reporting and handling requirements for agencies have been modified as well. Going forward, agencies will be required to report all suspected and confirmed information breaches to US-CERT. The memo formalizes the need for agencies to notify individuals whose personal information might have been compromised in a security breach.
Johnson's 22 May memo was released exactly one year after the disclosure of the massive security breach at the US Department of Veterans Affairs in May 2006. That breach involved the potential compromise of personal data belonging to over 26 million veterans.
The memo follows through on a set of interim recommendations released in April by the President Bush's Identity Theft Task Force. The task force offered nine specific recommendations for protecting personal data and responding to data breaches that it wanted the OMB to communicate to all federal agencies. It is those recommendations that were articulated in Johnson's memo of last week.
