What's In Your IT Security Policy?

Ever wonder what happened to those headline-grabbing worms and viruses we used to read about? They're still out there, according to security experts, but the hackers and criminals who produced them learned a valuable lesson. Too much publicity is not good for the hacker industry.

So the producers of these cyber attacks have grown more sophisticated, and have turned to developing stealthy trojans that require human interaction to trigger their mischief. According to the BBC, hackers are also manipulating file-sharing networks and popular websites to launch their attacks.

Interestingly, most government IT security problems have to do with lost or stolen data, not data breaches, according to experts. Many of the problems occur because of lax policies governing the use of laptops outside of the office, the use of USB devices and PDAs that lead to data leaks and breaches.

According to public sector CIOs I've talked to recently, all it takes is one well-meaning worker who brings a government laptop home for some work, lets it get in the hands of their kids, who surf the 'Net in the evening and pull in a virus. The next day, the worker returns to the office plugs in his laptop (which hasn't been quarantined and checked prior to logging on to the agency network).

Bingo! The government agency's network has been breached.

The solution, according to government and industry experts, is to keep updating public sector security policies so they keep pace with today's modern, fast-moving technologies. It isn't simple, but we have no other choice. The target for security breaches and leaks keeps changing.

Given the importance of this topic, Public CIO will start regular coverage of IT security issues this fall. Look for our new security column in the October issue, written by Dan Lohrmann, chief information security officer for the state of Michigan. Dan will bring his knowledge and know-how on IT security matters for CIOs throughout the public sector.

Stay tuned.