In the war over government data security, the statistics indicate the bad guys are winning. And some security experts say any hope of reversing that trend will take "a whole new paradigm" in IT security.
The U.S. Government Accountability Office (GAO) reported last week that federal data breaches involving unauthorized disclosures of personally identifiable information increased by 19%, or about 13,000 to 15,500, from 2010 to 2011.
At least some of the time, victims of those breaches are being left in the dark about it for months. About 123,000 Thrift Savings Plan participants whose personal information was compromised in a July 2011 breach were not notified until this past May.
That is not the only instance. The Washington Business Journal reported that the U.S. Environmental Protection Agency (EPA) waited until last week to notify 5,100 employees and 2,700 "other individuals" of a data security breach last March that exposed their Social Security numbers and banking information.
Greg Long, head of the Federal Retirement Thrift Investment Board, responding to questions from the Senate subcommittee on government management oversight, said the thrift board had followed federal guidance in responding to the attack, but didn't have the funding for a notification plan.
Daniel Berger, president and CEO of Redspin, a security assessment vendor, told CSO Online that the increase in breaches is no surprise, given that attacks have become, "more sophisticated and persistent. Groups such as foreign governments, organized crime, and hacktivist networks have the capability for multi-dimensional, coordinated, ongoing attacks against specific entities such as U.S federal agencies."
Berger said traditional perimeter defenses and other security controls are "no match for such attacks. A whole new paradigm is needed."
Tony Busseri, CEO of Route1, an IT security firm, suggested to Federal Computer Week that a piece of that new paradigm has to include better technology.
The EPA breach, reportedly caused by a virus in an email attachment on a contractor's computer, points again to the vulnerability of human error.
"We cannot just have policy-based approaches to cybersecurity," Busseri said by email. "It has to be technology-based too. If we rely upon the human condition - i.e., we expect someone to adhere to a policy -- and that's the only protection we have, we're going to have failure. By nature people are prone to making errors."
John Steven, internal CTO of Cigital, also said technology is lagging, especially when it comes to protecting usernames and passwords. "Credential thefts are not new vulnerabilities," he said. "These are system bugs that have been there for seven years and are being exploited now."
Steven said that is happening in both the private sector and government. "When the Yahoo [data breach] story broke, I went back and looked at three of my clients. We had reported critical vulnerabilities in password protection, an they had opted not to fix them," he said.
And the problem is made worse because of the human factor -- too many people using the same user name and password for multiple sites, he said.
Tanya Forsheit of InfoLawGroup said it is too simplistic to conclude that the GAO's statistics mean there is an actual increase in breaches.
It could be that there is better and more accurate reporting of them, Forsheit said. However, she added that "policies, procedures, controls, etc. -- a strong information security program -- is the best medicine to mitigate the risk of a breach."
"It does not mean that breaches won't still happen, of course," she added. "There is no such thing as perfect information security."
Still, shouldn't there be a requirement for more timely notification of potential victims of breaches?
The problem, say both Forsheit and Daniel Berger, is that there is no single standard. "State and federal breach notification laws govern how quickly an organization is required to notify affected individuals of a breach," Forsheit said. "Those deadlines depend on the particular law involved. The 46 state laws are all different, and the federal laws that do exist -- under HIPAA/HITECH, and separately for federal agencies -- are different still."
John Steven said he would support a stronger, unified policy on notification, but added that it will not cure the problem on its own. "It's one leg of a stool," he said. "The key is to build the system correctly, so it is designed to protect credentials."
"I'd highly recommend a federal standard for breach reporting requirements across all industries," Berger said. But he adds that he believes data security has to evolve to "a more holistic, data-centric approach to confront current threats."
Everybody from enterprises to government agencies should be asking themselves what are their most critical corporate information assets, Berger said, along with other crucial questions, including: "How is this data used, transmitted, and stored? Are access control policies in place and enforced? Have we integrated mobile computing, whether it's corporate issued-devices or BYOD, into our policies and procedures? How do we monitor use? Are my employees sufficiently aware of what constitutes acceptable use and practice from the IT security perspective?"
Read more about data privacy in CSOonline's Data Privacy section.