IT security and the contractor

The Veterans Affairs Department learned the hard way about requiring contractors to secure government data.

VA officials thought a contract under which Unisys Corp. debugged software had adequately spelled out security procedures. They found out otherwise when a subcontractor’s employee allegedly stole a PC with personal data on 16,000 patients.

“Had we done that diligently, we may have said, ‘If you have large amounts of sensitive information that is VA-protected, you need to work with that inside
a data center,’ ” said VA’s CIO Robert Howard. “We could have insisted on it, had we thought through it at the time.”

With hindsight, Howard said, the agency could have been more specific about security details in the contract, such as requiring use of a tiered data center or removing data when it is no longer necessary to perform activities.

VA isn’t the only agency rethinking how to better protect personal data that contractors use when performing work for federal customers.

The flood of security breaches earlier this year spurred agencies to reinforce procedures and fill gaps in security policies. The Office of Management and Budget also has issued several memos containing security guidance.

Security efforts have focused both on agency employees and contractors. The Agriculture Department, for example, requires contractors to take security training before gaining access to systems, said Agriculture chief information security officer Lynn Allen.

“The one thing that contractors cannot circumvent is that they have to have that training to access our system,” Allen said.

As the government has increased the amount of work it outsources, contractors have gained greater access and have been responsible for many federal data breaches, a recent House Government Reform Committee report said.

Despite the breaches, OMB believes the requirements are clear. Officials said the Federal Information Security Management Act sets guidelines on how agencies can secure their systems and data with contractors.

“FISMA includes specific reference to agency responsibilities to ensure the security of their information and systems, including those operated by contractors or others on their behalf,” said OMB spokeswoman Andrea Wuebker.

Ron Ross, a senior computer scientist at the National Institute of Standards and Technology, said the Federal Acquisition Regulations recently added specific language that points to FISMA as well.

According to FAR, “The agency head or a designee shall prescribe procedures for ensuring that agency planners on IT acquisitions comply with IT security requirements in” FISMA.

But experts inside and outside of government say that data security will take more than agencies relying on standard language in contracts or the fact that FISMA applies to contractors.

In requests for proposals, agencies need to be clear about what data security will be expected of those who offer proposals, Howard said. Those provisions should be among the terms when they finalize contracts. VA, for one, is scrutinizing how it can enhance standard clauses for data protection.

“There may be specific clauses that are much more stringent that you need to put in that further tie down and make clear what are the contractors’ responsibilities regarding protection of sensitive information,” Howard said.

VA also will introduce specific clauses in new contracts, but likely not add them to existing contracts. Howard said modifying existing agreements could end up costing VA more money because the provisions were not stipulated in the original contract.

“In the meantime, we have formally requested that contractors abide by the directives and regulations voluntarily,” he said.

USDA is taking a similar tack. It currently does not go beyond the standard clauses, but requires in the contract that vendors meet all security standards applicable to the data, Allen said.

He relies on employees and contractors following policies and procedures enforced through oversight and consequences. They must complete security and privacy education and training via the AGLearn online training program.

Generally, to offset gaps by contractors in complying with FISMA, USDA depends on its inspection of IT investments for how vendors protect systems and data as part of its capital planning investment process, Allen said. Vendors also must certify and accredit systems, including the confidentiality, integrity and availability of data.

The department assures that contractors protect sensitive data through two processes that extend in part to contractors: the A-123 review process over internal controls, and various audits by the Office of Inspector General and for FISMA.

VA’s experience with the most spectacular data breach—the theft in May of a
laptop with information on millions of veterans, which was later recovered—prompted officials to prioritize 300 activities, including data security conditions
applicable to contractors using its data.

“The one thing that leaps right out at you is [that] there is not enough inspection, not enough onsite look at where the activities are being performed,” Howard said.

The sooner, the better

Agencies should specify their security requirements in the beginning of the procurement process as part of the scope of work and embed them in the statement of objectives, said Greg Baroni, president of Unisys Global Public Sector.

Agencies typically bring up data security at the end of the contract process. It’s not even discussed, he said.

“You’ll look at standard language, and from there you’ll interpret what they mean, say, by the data, the IT that surrounds the data, the secure layer,” he said.

Trust and transparency also are important between the parties. Agencies and contractors need a governance mechanism by which they can interact on the issues, he said.

Another data security expert said that relying on standard security clauses and the fact that contractors also must comply with FISMA falls far short of what agencies need. FISMA requirements are too open-ended, and NIST documents bury the most important defenses, said Alan Paller, research director at the SANS Institute in Bethesda, Md.

“The great missing ingredient in cybersecurity right now is detailed security specifications in every system integration contract,” he said.

For example, agencies now are implementing full-disk encryption for their laptops that contain sensitive data. Agencies need to tell their contractors directly to do likewise.

“If it’s not a clause in the contract, it’s not happening,” Paller said.

The Government Accountability Office agrees, said Gregory Wilshusen, GAO’s director of information security issues.

“Doing so can provide agencies with a mechanism for holding contractors accountable and with an opportunity for recourse if contractors default on their contractual responsibilities,” he added.

In other words, “You don’t pay them if they don’t adhere to it,” Paller said.

Agencies should focus on using procurement to do the simple things that are important to protect data, Paller said. These would include encryption, intrusion prevention, fixing vulnerabilities, and testing backup and recovery. He advocates attack-based metrics, which measure the degree to which an agency defends against known attacks.

The Housing and Urban Development Department is one of the few agencies that already specify in RFPs what data protection it expects from contractors, said HUD CIO Lisa Schlosser.

These measures may include annual security training, inspection of contractor sites and systems, and permission to perform regular vulnerability scanning.

Performance-based contracts are an important step toward making sure contractors implement security requirements, Schlosser said. “It makes for more accountability.”

It’s also critical to have an incentive for contractors to meet or exceed minimum standards.

“But where the service provider is not meeting the standards, there is a way to penalize the vendor,” she said.