Tom Hughes | A model for security

The Social Security Administration’s Tom Hughes has been CIO for almost four years, making him a long-timer compared with most federal CIOs. He came to Washington from Texas wanting to make a contribution by bringing effective private-sector business practices, business transformation and technology practices to the agency, he said.Under Hughes’ stewardship, SSA has attained top grades in IT security, far outstripping most federal agencies, which average a D+ on the annual congressional scorecard for the Federal Information Security Management Act. Social Security has also earned the highest rankings in e-government, human capital, financial management and budget, and performance integration on the President’s Management Agenda.HUGHES: Anytime someone tries to gain access to that kind of record, there is a matching agreement process and specific provisions, and security and privacy requirements that each of these data exchanges must meet. It goes through a series of evaluations from our general counsel, from our systems group and information security officer, and they are signed off before we will deploy any type of matching agreement with our partners.HUGHES: To be fair, Social Security has a particular operating model. We have a retirement process and disability process. We have a mainframe type of application. We have a lot of LAN servers, obviously. But we also have a lot of strict policies and procedures. We use only the best security monitoring features that we can find to run on our mainframe applications. And we have a commissioner [Jo Anne Barnhart] who is dedicated to privacy and security. That’s actually passed down to our executives. When we call a security meeting, everybody shows up. Our A+ in FISMA, I think, is from working closely with the inspector general.We take very seriously the certification and accreditation process. It is not a paper procedure here. I think you can improve FISMA. There are parts of FISMA that you can check off yes, yes, yes. FISMA is a very good foundation to be successful. But just because you have good FISMA scores doesn’t mean that you have a perfect security environment. It means that you meet the criteria for FISMA. We’ve passed the first part of the test. We have a lot of paper records and other processes that FISMA doesn’t include which I think we go beyond. Those are the policies and procedures that we try to take with our managers and employees.HUGHES: Some agencies have a much more complicated operating model. I’m not suggesting that our model is easy. But the more agencies and sub-agencies that you have, the more complicated your model becomes. We have a single type operating model for an agency. It helps in making decisions.HUGHES: There’s pressure to improve that through the Office of Management and Budget memos, such as reporting instances, encrypting your laptops, two-factor authentication and timing out of machines.When you have millions of paper records, when you have 150,000 machines, accidents are going to occur. What we want to be is very vigilant, so that when we get a notice that something is missing, senior management is immediately notified and takes appropriate steps.HUGHES: FISMA is really about trying to put in place security controls. This year we’ve taken a stronger approach to testing our security controls. That means you’re testing and making sure that you have the correct security controls in place for all employees. You have the proper profiles and have audited and reviewed those profiles, and made sure that people who have a particular category have the appropriate security profile category. If you’re a field manager and you become a supervisor, you don’t have two types of authority controls just because somebody forgot to audit you out of the system.We’re going through all security controls for all aspects of our employees and testing them to see if they make sense for that employee. We’re reviewing all those access controls for the entire agency.I’ve sent out e-mail sometimes to 80,000 people at one time reminding them of their security responsibility at the agency. We send out a lot of security notifications, reminding employees how to manage, for example, their password protection. I think we’ve done a better job this year with our security handbook and informing our employees about their responsibility.HUGHES: Card issuance begins in October. We have a human resources review process of all the employees. You’ve got to go back and review the security of certain employees more than others. We are buying machines that will have the smart-card capability in the workstation and keyboard. As we go through our refresh cycle, we’re replacing those desktops with card-capability access to the reader. We are replacing over 30,000 this year.The October deadline means just getting started, from my view. Around February or March, you’re going to find out how really complicated it actually is. People will start using this smart card in their agency. Then they’re going to start talking about cross-agency logical access capability. I think that’s where there’s going to be certain stumbling.HUGHES: The General Services Administration is the prime for these E-Authentication projects. We were one of the first agencies to get started with GSA on E-Authentication projects. We’ve worked with them on pilot projects with Fidelity Investments and the banking industry, and we piloted out credential service providers and proof of concept for some authentication capabilities. What we found is that it’s a technically feasible project. We’re hopeful that a recent request for information will tell us about businesses with which we could hook up for this capability.HUGHES: Our goal is to roll out voice over IP to all 1,400 offices. That is one of the largest VOIP projects in the country. The goal is to roll out in the hundreds of offices annually, 300-400 offices a year. We have 40 piloted offices.Also we are building a second national computing or data center. That’s a major project to be able to duplicate or co-process a workload from a second location. It’s both a COOP [plan] and for capacity. It’s budgeted. We’ve had conversations with GSA. We have a plan over the next 12-18 months to deploy it to run at a good capacity.