GOVERNMENT TECHNOLOGY/Protecting assets
Information security is a race to ensure that organizations are prepared for hackers that try to penetrate their networks or launch cyber attacks on their infrastructure. A city’s or county’s IT staff and, by necessity, all employees and residents share the responsibility to prepare for those events.
When it comes to creating homeland cyber security, awareness is Arlington County, Va.’s weapon of choice. Education about computer security starts with its executive leaders and continues throughout the county, including residents.
Very few of the county’s 3,500 employees have jobs that focus on security issues, but the IT staff ensures that all of them are aware of computer security matters. At new employee orientations, employees learn about the role of cyber security within daily business operations. Computer security education is reinforced through a variety of methods, including training classes, e-mails and news briefs. An information security section on the county’s intranet and a monthly newsletter highlight concerns, such as laptop security, new viruses and e-mail scams.
The county delivers its security awareness campaign to the public, as well. It recently created a Community Alert System that delivers real-time alerts about emergencies through e-mail and mobile devices — including cell phones, pagers and PDAs — to people who live or work in the county. Late last year, the county added cyber alerts to the system, so residents can receive government-issued messages about viruses or patches for software. The county also offers computer security advice through public service announcements on its government cable channel.
In addition to educating computer users about security, the county uses software to help protect data and assets. For example, to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), certain county departments that deal with health-related information must ensure the privacy and security of the data they collect. As a result, laptops that require additional security are equipped with a centrally managed encryption product, AbsoluteEncrypt.
Laptops represent an increased security risk, as data may be taken outside the relatively secure office environment. The encryption software creates a password-protected storage area on the laptop where sensitive information can reside. The software helps the county comply with HIPAA by preventing unauthorized access to private and confidential files. Administrators can remotely lock out a user from accessing an encrypted area, even if that user knows the password.
The county also has installed laptop-tracking software, called ComputracePlus, to keep track of its entire wireless mobile workforce. If a computer is stolen and the thief logs on to the Internet, the software can track the location of the missing computer. The software also allows authorized administrators to remotely delete data on lost or stolen computers that contain sensitive information.
Arlington County is determined to stay one step ahead in the information security race. Through an extensive computer security education campaign and software tools, the county is building a legacy of cyber security that protects residents as well as its infrastructure.
The author is chief information security and privacy officer for Arlington County, Va.