Governments are collecting increasing amounts of data about their citizens, and the need to handle all of it in a secure way is motivating ministries, departments and agencies to improve their IT security infrastructures. Although some are embracing the new defence imperative willingly and quickly, others are finding it a much tougher challenge.
It was the sort of episode CIOs - and CEOs for that matter - have nightmares about. A visitor to a Web site discovered he could view personal information about others who had used the site. The site had to be shut down temporarily, and the story was all over the press.
There have been many such stories, but this particular one didn't involve a private-sector business. It was Passport Canada's online application system where, late last year, Huntsville, Ont., resident Jamie Laning browsed other people's personal data by altering the URL displaying the data he had entered himself.
Passport Canada did not respond to requests for comment, but more may be known about what went wrong when the federal privacy commissioner's office completes an audit of the department - which was already in progress when the incident occurred. The audit report is due some time this spring. The privacy commissioner's office did not respond to requests for further comment.
Was this breach an isolated incident, or a symptom of broader problems with the security of personal data? Maybe some of each. David Senf, director of Canadian security and software research at International Data Corp. (Canada) Ltd., says governments probably do a better job than many businesses when it comes to security. "The public sector is up there with finance as an industry that understands the importance of security," Senf says.
That said, he adds, everyone has work to do in the area of online applications security. "Web application security as a focus is on the increase, so we are seeing more attention being paid to that."
"Seventy-five per cent of new attacks now exploit software vulnerabilities, and most of the IT security dollars are spent bolstering up the security on the perimeter of the network," says Brian O'Higgins, chief technology officer at Third Brigade Inc., an Ottawa-based intrusion prevention system provider.
Proposed registry
And for governments, a comparatively good job of security may not be enough. "We're dealing with the government here," says Derek Manky, security research engineer at Fortinet Inc. in Vancouver. "We're dealing with a very high level of sensitive information."
According to Manky, the Passport Canada breach shouldn't have happened. There wasn't even a deliberate attempt to penetrate the database, he points out. "This was simply a matter of private information being made available to the public."
The Canadian Internet Policy and Public Interest Clinic (CIPPIC), based at the University of Ottawa's law faculty, recently called for a centralized electronic registry of data breaches, to which private-sector companies would be required to report unauthorized data access.
CIPPIC is focusing on the private sector because of current consultations on reforming a data protection law that applies to business, says Philippa Lawson, director of CIPPIC, but "there's no reason why the same rules shouldn't apply to the public sector."
Lawson says it appears the government is receptive to creating a compulsory registry of private-sector data breaches. Yet there is currently no such requirement for the public sector in Canada, with the exception of Ontario's Personal Health Information Protection Act.
Garnering praise
Like Senf, Lawson has some good things to say about governments' efforts to secure citizen data. She applauds Ottawa's decision to create separate databases for different online government services rather than throwing everything together in one master database of citizen information - an approach that she says would undoubtedly have been quicker and easier but also a greater privacy risk. "The larger the database, the bigger the attraction to criminals is."
The federal government's best-known security initiative is Secure Channel, which combines a secure network, secure message routing and public-key infrastructure (PKI) user authentication technology called epass. Initiated by Treasury Board Secretariat, it is run by Public Works and Government Services Canada.
In e-mail responses to questions for this article, representatives from both departments said all government departments use the secure network and all departments will use the other Secure Channel components by 2011.
Secure Channel only deals with authentication and secure data transfer, though. It does not affect the security of individual Web applications.
That's the responsibility of individual departments, according to the prepared answers, although the Treasury Board issues directives and provides support to ensure proper security measures are taken.
The federal government's security efforts have met with mixed reviews. Secure Channel received a silver award for customer care in the 2005 Canadian Information Productivity Awards, yet in the same year the federal auditor-general said that, overall, the government had made "unsatisfactory progress in strengthening information technology security since our audit in 2002."
There are some encouraging stories in public-sector information security in Canada, though.
Service New Brunswick, a Canadian pioneer in electronic government services when it launched in 1996, addresses security on a number of levels, ranging from determining how long data is retained on a case-by-case basis to scanning Web applications for vulnerability to exploits such as SQL injection attacks.
Every time Service New Brunswick adds a new service it goes through a risk analysis, says Dorothea Foley, director of information technology for SNB. That analysis addresses security, privacy and data retention issues.
"Typically, we only keep it for as long as we need," Foley says. Service New Brunswick's privacy officer reviews data to be collected, and if she considers it toB be personal information, it is encrypted for as long as Service New Brunswick retains it.
In some cases, SNB acts as a front end for government departments, in which case data is passed to them, "at which point their policies on data retention would take over," Foley says. In some cases - with land registry data, for instance - the information is kept indefinitely.
All SNB applications run on hardened servers in secure government data centres with perimeter and server-level firewalls, intrusion detection, antivirus and antispam software and physical access controls, Foley says.
The agency frequently uses outside contractors to develop Web applications.
"The companies we deal with tend to be ISO-certified," she says, "so that gives us some level of assurance on the quality of the work they're doing. We do monitor their work, we have an internal quality assurance team who test all applications and security testing is integrated into that."
That specifically includes checking for problems like back doors and cross-site scripting and SQL injection vulnerabilities. "All our outward, public-facing stuff is scanned monthly to ensure that there's nothing there that's going to pose me any risk," Foley adds.
Just recently, out of concern about loss of data being sent via e-mail to other government departments, Service New Brunswick created a secure system called Self-Serve Reporting, which allows internal and external clients to log in to a secure server, authenticate themselves and download reports and data from SNB's systems.
Legacy systems pose some of the greatest security challenges, Foley observes. Designed in an era when most government systems weren't connected to the internet and security was less of a concern, they need updating to contend with today's threats.
"With today's technology you can Web-enable the front of it and off you go," Foley says, but security requirements increase dramatically.
The Public Health Agency of Canada created the Traveller Health Assessment Database in response to concerns about Avian Flu and other pandemic disease outbreaks. It collects data from travelers who arrive at Canadian airports with symptoms of illness and are examined by 25 to 30 quarantine medical officers across the country, says Dr. Elaine Cramer, a quarantine medical officer in Vancouver. Smaller airports see fewer.
Database decisions
The first security precaution with the database is that no data that identifies individuals goes into it, Dr. Cramer says. Officers at the airports keep paper files on the passengers they examine, but only aggregate data goes into the national database.
The tablet PCs that quarantine officers use have fingerprint readers as well as password protection, says Hany Bishay, chief of application and architecture development for the Public Health Agency of Canada. Data on them is encrypted, and the agency is buying encrypted drives that could not be read even if removed from the devices.
Data is transmitted to the central database using virtual private network (VPN) and Secure Sockets Layer (SSL) technology, Bishay says. Rather than take chances with wireless access for officers in the field, data is synchronized with the central database over secure connections when they return to the office.
Bishay says policy management practices control who has access to what data, based on need. Each screen a user sees is drawn on the fly based on that user's security privileges, so that for instance only users qualified to generate reports from the data will see the report option on their screens.
During application design, the agency has IT staff members whose job it is to test the applications for vulnerability to SQL injection attacks and similar threats by attempting intrusions.
These examples show that some government agencies pay close attention to security. Many others are unwilling to discuss what steps they are taking, so it is hard to know if such precautions are the rule or the exception. But incidents like the Passport Canada breach help underline the fact that government can't afford to let its guard down.
"Security is not something you set up an annual project for and then you're done," says SNB's Foley. "It changes daily."
Related content:
Passport Online breach adds to privacy chief's audit list
PWGSC defends Secure Channel
Big IT projects fumbled by feds, says Auditor General's report
icon.
