A secure strategy for online services
Los Angeles and Orange counties in California, two of the nation’s largest, standardize on suites to improve security and simplify administration of their enterprises
TWO OF THE NATION’S largest counties are coming to grips
with one of the primary challenges of online government: providing
Web-based services while managing sensitive information
securely.
Los Angeles County in California and its neighbor to the
southwest, Orange County, are adopting product suites from single
vendors to help manage the security of large enterprise networks
and prevent data leakage.
Los Angeles County, the nation’s most populous county with
10.5 million people and 88 cities, is in the second phase of a data
protection initiative aimed at securing data residing on or moving
through almost 90,000 desktop and 11,000 laptop PCs.
It is not a trivial task, said county Chief Information Security
Officer Robert Pittman. The county has a population larger than 43
states’, he said, with an annual budget of $22 billion, with
an $800 million information technology budget for 38 departments in
70 locations.
The initiative began about two years ago with the encryption of
all laptop hard drives. In the second phase, the county is focusing
on monitoring and controlling the use of removable storage devices
on laptops and computers with a suite of tools from Safend, of
Israel. Agencies are in the early stages of implementing Safend
Auditor to do device discovery, Protector to enforce policy on
removable devices, and Reporter for reporting.
Orange County, the third largest U.S. county with a population
of 3 million, is upgrading an outdated information security
infrastructure, standardizing on a suite of products from Secure
Computing.
Tony Lucich, the county’s CISO and enterprise architect,
said the existing, heterogeneous systems had been in place for
years and needed to be replaced when he arrived at the county four
years ago.
“The systems were fine if Web traffic was 15 percent of
your bandwidth, but they didn’t meet current needs,” he
said. Threats had also evolved. “About 70 percent of the
sites you go to today are infected,” and spam is a much
bigger problem.
To simplify the architecture and address current threats, the
county picked the Secure Firewall to protect its perimeter, Secure
Mail to protect and enforce policies on email, and Secure Web to
enforce Web policies and filter incoming and outgoing traffic. Each
of these products incorporates TrustedSource reputation-based
filtering to block or flag traffic from questionable sources.
The counties arrived at standardized solutions through different
routes. L.A. County chose the Safend suite as a single solution,
entering into a master purchase agreement with the Vantage Group, a
consulting firm and reseller.
Orange County selected the Secure Computing suite one product at
a time after a series of pilot programs and trials by different
agencies.
“It was very difficult and competitive,” Lucich
said, with a separate competition for each element. “We
couldn’t just use something because we’d dealt with the
company before. They came back with a single vendor that met all of
their needs.”
The first issue addressed in L.A. County’s security
initiative was the potentially sensitive information held on its
11,000 laptop PCs. The first challenge was identifying exactly what
constitutes sensitive or personally identifiable information, which
varies with different agencies’ regulations.
“You can break it into four areas,” Pittman
said:
- Health and mental health data falls under the federal Health
Insurance Portability and Accountability Act.
- Data for Children and Family Wellbeing and other social
services are regulated by state welfare codes.
- Law enforcement and legal information are controlled by the
local district attorneys, public defenders offices and police
agencies.
- General government information in business, taxes and other
services is covered by state and federal privacy laws.
“They each have their own definition of what data elements
constitute personally identifiable information,” Pittman
said. So rather than have each agency establish its own policies
for encryption and data protection, he said, “the simplest
solution was full hard-disk encryption” for each laptop. The
county settled on Endpoint Security Full Disk Encryption from Check
Point Technologies, based on the product originally developed by
Pointsec Mobile Technologies.
The second phase of the data security initiative addressed the
potential problems that could come from portable devices —
CDs, thumb drives, external drives, and every other kind of storage
unit that can be linked to a computer through a USB port or
wireless links such as FireWire, Wi-Fi, Bluetooth or infrared.
Keeping tabs
The Safend Data Leakage Prevention suite helps control ports and
devices and monitors which devices are in use.
The Auditor product maps all media and devices connected to
networked computers using a temporary client agent sent via the
server. It collects data from the computer’s registry and
then is deleted. Protector uses a client agent to control ports and
removable media in real time through policy enforcement.
One server can manage as many as 30,000 endpoints, said Edy
Almer, Safend vice president of product management. “We
don’t have a scaling limitation,” he said.
Unlike the countywide mandate for full-disk encryption, each
agency is pursuing its own policy in implementing removable media
controls, based in part on individual regulatory requirements.
In Orange County, the challenge was replacing the outdated IT
environment with an integrated system for providing services to
agencies. “We wanted to build a federated organization for
the county, with a simplified infrastructure,” Lucich
said.
The process of defining needs and identifying an architecture
required a lot of pizzas and sodas. “If you provide food,
they will come,” he said. Lucich hosted a series of speakers
from agencies and vendors, looking for areas of common need in
which a common infrastructure could be applied.
Orange County chose Secure Computing suite through a series of
projects in which agencies partnered to test solutions. The Secure
Firewall, Web and Mail products emerged separately as winners, and
they were not originally acquired as a single suite. However,
ending up with a suite from a single vendor has improved efficiency
of information security operations, Lucich said.
The tools are centrally located in the county’s data
center, but administration of Web filtering, e-mail filtering and
encryption are shared with each agency. Firewalls are handled
separately. Each agency has its own set of rules in the firewalls,
but management is done only by the data center’s security
team.
The result has been a simpler security infrastructure. “We
used to have 57 firewalls,” Lucich said. “We’re
down to eight now, with much simpler administration.”
The next phase of L.A. County’s security initiative will
address data leakage, focusing on how confidential information is
handled and transferred, and accounting for all data that must be
retained and made available under e-discovery requirements.
That probably won’t begin before the third quarter of
2009. In the meantime, Pittman is happy with the improvements to
the county’s data security.
“I have very little time to sleep,” he said,
“but I do sleep well when I do."