Digital Doorkeeper

The theft in November of a notebook computer from the Army Cadet Command’s headquarters at Fort Monroe, Va., placed the government’s information technology security policies and procedures in the spotlight — yet again. A database file on the computer held personal information about 4,600 high school seniors, applicants for Army ROTC scholarships, and included their Social Security numbers, birth dates, home addresses, phone numbers and parents’ names.

The focus on IT security in government and the many high-profile privacy violations that have taken place in recent months has led to the creation of IT security leadership positions at the city, state and federal levels. Primary among these is the chief information security officer or CISO. These top-level security chiefs have become prevalent — emerging as information assurance policy and strategy leaders.

A Natural Progression

States have faced a number of high profile IT issues over the past 10 years or so. The Year 2000 issue focused attention on the IT aspect of state agency operations. Committees were formed across various agencies and departments to address the crisis that might have developed as a result of computer programs storing the year with only two digits instead of four. Part of Y2K planning was contingency planning to ensure that the most critical services, such as medical, police and fire services, would keep running come Jan. 1, 2000. Many states built elaborate backup systems and developed failover and recovery policies and procedures.

What began as Y2K preparedness turned into disaster preparedness and emergency response after the terrorist attacks on the World Trade Center and the Pentagon on Sept. 11, 2001. City, state and federal governments saw an immediate need to organize IT as a central function so they could manage systems more easily in an emergency. Information security came to the forefront as every aspect of government was examined to find ways to prevent further attacks by securing systems and tracking potentially dangerous individuals.

Emergency preparedness continues to be important for governments in the wake of such disasters as the 2003 blackout and 2005’s Hurricane Katrina. But there’s more to the expanding role of the CISO than emergency preparedness.

In general, state governments, businesses and individual citizens have grown increasingly dependent on technology over the past 15 years. The challenge of protecting state systems and the information that resides on them has grown more complex, as has the challenge of ensuring that businesses and citizens can conduct business securely and reliably over the Internet. Several high-profile information leaks by state and federal government have led to an erosion of citizen trust. Threats such as hackers (both vandals and genuine criminals), viruses, spyware and denial-of-service attacks are real.

“Initiatives such as mobile work, centralization of data centers and VoIP have prominent security components,” says Michigan CISO Dan Lohrmann, who helped coordinate the IT emergency response to the 2003 blackout. All of these factors have led states to create centralized information security functions headed by CISOs.

“The challenge is building security into the entire lifecycle process of everything state agencies do,” Michigan CISO Dan Lohrmann says.

The complexities of state government have created the need for a position with an enterprise view of IT security. The holder of this position, typically given the title of CISO, must make sure that all state agencies meet minimum IT security requirements. In the beginning, state CISOs primarily focused on responding to daily threats, but over the past few years the position has evolved into one of IT security policy leadership. “Initially, one of the biggest challenges was just getting people’s attention; now the challenge is building security into the entire lifecycle process of everything state agencies do,” says Lohrmann.

State CISOs must educate their governors, state agency leaders, legislators and citizens about information security. They also must form and maintain good relationships with homeland security and emergency management officials to ensure that government systems are protected.

Governance and Authority

There are concerns that having the CISO report to the CIO may create a conflict of interest because those who manage an organization’s IT also oversee its security. As a result, Colorado and California created CISO positions that don’t report to the CIO. In Colorado, the position is in the governor’s office and reports to the governor’s chief of staff. California’s CISO is part of the state’s department of finance.

Independence is great, but the CIO and CISO must work closely together to create and enforce IT security policy and procedures. The CISO must wield sufficient authority to properly carry out his or her duties to secure the state’s IT function. The CISO must be able to provide guidance regarding IT security strategy at the highest levels of state government. “It is absolutely critical that we have excellent working relationships with contacts in cabinet-level agencies,” says Larry Kettlewell, CISO for Kansas. Also, state governments can show that IT security is a priority by placing the CISO in a high-profile position.

CISO authority varies from state to state, ranging from only a few state agencies to all three branches of government. According to the National Association for the State Chief Information Officers, most states have an enterprisewide CISO who develops and promulgates security policies and procedures for a federated organization. Most state CISOs have authority within the executive branch. Authority over educational institutions, such as K–12 and higher education, also varies by state. For example, Arkansas and Louisiana have CISOs with authority that encompasses higher education.

Some state governments have a council or forum to coordinate security functions among state IT officials. For example, Kettlewell chairs his state’s Security Council, which in turn recommends policies to the state’s IT Executive Council that has members from all branches of government as well as local and law enforcement representatives. “We have a federated IT governance structure and a very collaborative spirit throughout the enterprise,” Kettlewell says.