Slashdot Mirror
White House Demands Encryption for Sensitive Data
An anonymous reader writes "Stung by a series of data losses or disclosures at federal agencies over the past month, the White House is requiring all agencies to follow new guidelines when allowing employees to carry sensitive data on laptops or access the information from afar, according to the Washington Post. From the article: 'To comply with the new policy, agencies will have to encrypt all data on laptop or handheld computers unless the data are classified as "non-sensitive" by an agency's deputy director. Agency employees also would need two-factor authentication -- a password plus a physical device such as a key card -- to reach a work database through a remote connection, which must be automatically severed after 30 minutes of inactivity. Finally, agencies would have to begin keeping detailed records of any information downloaded from databases that hold sensitive information, and verify that those records are deleted within 90 days unless their use is still required.'"
And the real question is: Why wasn't all these measures mandatory before? Did noone thought of the potential problem of a user going home with his laptop before?
Write boring code, not shiny code!
Speaking of which, you should probably get a glimpse at what Google .Gov dragged up.
Just "recommendations".
Which means this is likely to have zip for effect.
Sheesh, evil *and* a jerk. -- Jade
As it stands, the only thing these leaks are doing is proving to your average American that, hey, Bush really is the bastard the ultra-liberals decried him as in the first place.
Except that the "average American" is not quite as "average" as the classist ultra-liberals envision him. What it really does is cause the "NASCAR Dads" and "Soccer Moms" to get even more disgusted with the mainstream news spigots and start seeking less-biased and more representative sources. That, of course, can only hurt the bottom lines of the Old Guard.
To successfully compete with an Internet across which one can aggregate news (and opinions) from all over the political spectrum, a traditional mainstream outlet will have to either clearly claim allegiance to one pole (e.g., Fox News) or genuinely have no political leanings or agenda (e.g., nobody right now). The days in which an outlet can pose as unbiased while actually trying to manipulate opinion with stories slanted either left or right are dwindling, or so say the accountants...
Beset with yet another layer of Policies, Programs, and Procedures the things a bureaucracy will need are:
feasibility studies
staffing increases
training
miscellaneous budget increases
Does anyone know the source of that quote in the Civilization IV game:
The bureaucracy is expanding to meet the needs of an expanding bureaucracy.
[1] I am making this up.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
...and require that ours are kept stored for months or years, or even "forever"? Is it me or is something running very wrong here? ...
... Not the government has to monitor its people, it is to be done the other way around.
Come on now, it's way too hot outside for tinfoil apparel.
We're talking about data that's copied off to laptops for mobile use. Copied. The concern is over some federal worker or contractor dumping some subset of sensitive data (say, YOUR information?) off to a laptop while working on some report or mindless budget slide show. The issue is making sure that grabbed data isn't easily read by someone who steals the laptop. Whatever big momma database the data was extracted from is still sitting right where it was, behind the scenes. This isn't about "monitoring" you, it's about making sure that sensitive data, which might include yours, is not left lying around in some field office or a hotel room. You really think the founding fathers would have preferred the opposite? The article's not even talking about back-office database/file servers, which are a totally separate firewalling-ish conversation (though TFA does discuss clamping down on dangling remote access connections and requiring two-factor IDs for that, too). Drink more coffee (or less - whatever will get you thinking more calmly) before you post, dude.
Don't disappoint your bird dog. Go to the range.
Every week or so there's a news story about someone having a laptop stolen, or being lost, with thousands of customer files on it. I keep wondering why encryption isn't being used. Under Mac OS X, you click one checkbox to enable "FileVault" and everything in your home directory is encrypted. I don't know exactly what's available in the WIndows world, but I'm sure there are tools that are just as easy to use.
Of course, I don't use FileVault.
Why not? Well, it's one more thing to go wrong. I'm far more worried about losing my files or losing access to them, than I am about having other people look at them. And, frankly, I've never bothered to find out exactly what happens when you use a standard backup tool on a FileVault-protected Mac (presumably all the backups are UNencrypted if you are running the backup tool from within the protected account?)
So... I dunno. I don't understand why everyone doesn't use encryption, but I don't use encryption myself. Of course, I have reasons. Probably everyone else has reasons, too?
"How to Do Nothing," kids activities, back in print!
Actually the physical separation is much more important than just keeping people from sticking the media in the wrong drive. If that was the only issue, they could just color-code the computers and media and probably be OK.
The concern has to do with radiation produced by equipment; classified systems are shielded (sometimes) or kept in shielded rooms (more commonly, because actual shielded equipment is more expensive) with RF chokes on all the lines going in and out. The idea being that you don't want somebody to be able to listen to RF signals that your monitor on your classified system is putting out, by attaching an antenna to the building's cold-water pipe.
Where the problem gets even more complicated is that you can compromise a well-shielded system (one that doesn't radiate any information back into the power lines, etc.) if you put it close to an un-shielded (unclassified) system. The RF being produced by the shielded system will couple to the coils and whatnot in the unshielded system (which doesn't have any fancy chokes on its connections) and now you're back to radiating classified information into the building's power/water grid.
The '3 foot rule' is definitely arbitrary, but apparently it's the distance at which the people who are paid to think about these things believe that a classified system won't interact with an unclassified system and produce any significant radiation back into the building's infrastructure. If it sounds paranoid, that's because it is -- this was all Cold War era research -- but that doesn't meant it's not still true.
You're right though in saying that the artificial division between EMSEC and COMSEC and COMPUSEC is outdated and should be replaced with something more inclusive and relevant; however, the EMSEC precautions aren't completely outdated, and still exist for a reason where classified data is concerned.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
/. If the government wants us to respect the law, it should set a better example.
Why in the world would you want to take home a hard disk full of sensitive information, when you can work on it while it's stored at a remote location? It's called client/server, and we handle data that way at my job, and we're not even techie IT guys - it's just more secure and even we know that. If it's not on your laptop, it ain't gonna get stolen when the laptop is! Instead it's on a server in a locked room with some security around it. You don't need to take my identity home with you so you can get some work done on the freaking beach or while boffing your mistress, OK?