Cybereye | Data security can falter at the top
The failure of former U.S. aAttorney general Alberto Gonzales to
properly secure highly classified documents, revealed in a recent report from the Justice
Department’s inspector general, illustrates a common problem
in information security. Despite the best policies and technology,
the end user often is the weakest link in any security system, and
the higher up the organizational chart that user is, the weaker the
link tends to be.
The documents at issue were on paper, stored in safes and
carried in briefcases. But the security issues involved are the
same as if it had been digital information housed on a server and
transported by laptop. Gonzales’ lax handling of his
classified notes is exactly the same behavior that has landed
officials from the Veterans Affairs Department and the National Institutes of Health in hot water (and
on the front pages) when their laptops were stolen.
The IG investigation initially focused on handwritten notes
taken while Gonzales was White House counsel and concerned the
administration’s warrantless wiretapping program and the
interrogation of detainees. But during the investigation, the IG
wrote, “we learned of several other classified documents that
Gonzales may have mishandled. Most of these documents also
concerned the NSA [National Security Agency] surveillance program.
Other documents concerned a detainee interrogation
program.”
According to the report, both the surveillance program and
detainee interrogation are “classified at the Top
Secret/Sensitive Compartmented Information (TS/SCI)
level.”
The investigation concluded that “Gonzales mishandled
classified materials regarding two highly sensitive compartmented
programs. We found that Gonzales took his classified handwritten
notes home and stored them there for an indeterminate period of
time.”
Gonzales said he took the notes home because he was unaware that
there was a Sensitive Compartmented Information Facility at DOJ a
few doors down from his office. He had a government safe in his
home, but it was not cleared for SCI documents. And Gonzales did
not use the safe to store the notes because he had forgotten the
combination. The notes remained in his briefcase, which has a lock,
but he did not always lock it. His memories of the incidents, as
reported by the IG, are rather vague, but the gist of it is that
Gonzales thought it would be enough for him to be careful with the
documents.
This is analogous to carrying sensitive information around on an
unencrypted laptop or storing it on your office or home
PC—behavior which has cost more than one government employee
his job.
At first blush it might appear strange that the attorney general
of the United States and former White House counsel would be so
careless. But this apparently is in character for executives. They
ought to know better, but the prevailing attitude all too often is,
“the rules don’t apply to me.”
On more than one (and probably more than a dozen) occasion I
have heard IT administrators and security officers bemoan the fact
that policy enforcement breaks down at the C-suite, where
executives assume that security policy is somehow beneath them.
They transfer and carry around sensitive data, surf the Web and
remotely access resources with impunity because their time and
convenience are too important for them to be bothered with
security.
Hackers know this and take advantage of it. As online attacks
become more targeted, CXOs are prime targets because they often are
vulnerable as well as valuable. There is even a separate class of
phishing attacks aimed at CXOs, calling
“whaling.”
This does not mean that all executives are careless or that all
careless people are executives. But end users are the interface
between technology and policy, and all too often that interface
fails. If you were doing a risk analysis, the behavior of Gonzales
would have to be right up there at the top.