The Foreign Service Journal, September 2005

Internet also opens the door to increasing threats to the system itself — to the confidentiality of employee files and other records kept on the system, to the integrity of the data, and to the availability of the network. Mary Stone Holland, director of computer security for the Diplomatic Security Bureau, sums it up: “The department has to worry about the enter- prise [and] the network, and that requires certain controls.” Holland directs some 135 staffers who manage incoming threats, some working around the clock. A Computer Incident Response Team responds to intrusions, while a Cyber Threat Analysis Cell conducts liaison with other federal agencies. Diplomatic Security experts participate in the depart- ment’s 24/7 Network Management Center located in Beltsville, Md. Policy experts, technicians who test new applications in a lab environment, and 14 regional com- puter security officers also fall under Diplomatic Security. Her staff also includes the Computer Awareness Team, which provides a variety of training and promotional activities to make employees aware of the need for precaution on government computers. Holland declined to provide a cost figure for the effort. While Diplomatic Security takes the lead in cyber- security operations, the Information Resource Manage- ment Bureau, as overall steward of the computing and communications infrastructure, holds responsibility for assessing and managing risk. Chief Information Officer Jay Anania states: “The kinds of things you see in the newspapers are not theoretical threats. They are happening on our network every day.” State’s network firewall rejects an average of over 150,000 viruses and over 400,000 spam messages per week. DS and Information Resource Management Bureau staff together declared June “Cyber Security Awareness Month.” They sponsored activities such as a demonstra- tion of hacking and released information about how employ- ees can help counteract such threats. The joint awareness team cited 644 security problems encountered during the first 157 days of 2005. Actions by computer users can open the networks to vulnerabili- ties that result in damage, usually inadvertently. Security staff found a total of 265 infractions from January through May, break- ing them down into five types: 1) allowing unauthorized software on department computers; 2) connecting unauthorized hardware, such as a laptop, to the network; 3) configuring a computer in a different fashion from department guide- lines; 4) connecting directly to a machine that lies outside the network, bypassing firewalls (guard computers) and other network protections; and 5) visiting pornographic Web sites. The introduction of unauthorized software was the most common problem, encountered 180 times. Downloading games from the Internet, or software for video conferencing or chats, can create problems beyond the individual computer. It opens other net- work users to vulnerabilities. In 2003, a contract employee connected a laptop to OpenNet to check e- mail. The infected laptop introduced a worm into the system, eventually infecting computers in the European and Eurasian Affairs Bureau and forcing that entire bureau to be taken offline. State dismissed the employee from its contract staff for that action. Diplomatic Security is now developing a program that will penalize employee electronic infractions, just as it leaves “pink slips” where agents find classified paper documents in the open overnight. Security Increasingly Driven by E-Government The president’s “Management Agenda,” announced in the summer of 2001, stresses the use of information technology — termed E-Government — and cyber security is a major focus of attention. The E- Government approach standardizes and consolidates IT systems and programs behind common “best prac- F O C U S S E P T E M B E R 2 0 0 5 / F O R E I G N S E R V I C E J O U R N A L 53 Cyber security is not only about preserving proprietary or secret information, but also about keeping the system up and running to make the information available on demand. Joe Johnson recently retired from the Foreign Service after heading the State Department’s Office of eDiplomacy. He now works for the Computer Sciences Corporation as a part-time consultant.