12.07.2015 Views

Download PDF - Department of Navy Chief Information Officer - U.S. ...

Download PDF - Department of Navy Chief Information Officer - U.S. ...

Download PDF - Department of Navy Chief Information Officer - U.S. ...

SHOW MORE
SHOW LESS
  • No tags were found...

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

All <strong>Department</strong> <strong>of</strong> the <strong>Navy</strong> personnel should continue to increase their level <strong>of</strong> awareness aboutproperly safeguarding personally identifiable information (PII). To learn more about properlysafeguarding PII, go to www.doncio.navy.mil.The following is the July 2008 summary <strong>of</strong> recently reported losses or breaches <strong>of</strong> PII involving laptops or thumb drives. Laptop securitycontinues to be the foremost vulnerability in the <strong>Department</strong> <strong>of</strong> the <strong>Navy</strong>. Incidents such as these will be reported in each subsequentCHIPS magazine to increase PII awareness. Names have been changed or removed, but details are factual and based on reports sent to the<strong>Department</strong> <strong>of</strong> the <strong>Navy</strong> <strong>Chief</strong> <strong>Information</strong> <strong>Officer</strong> (DON CIO) Privacy Office.1 Jul 08 Government laptop stolen from locked hotel room.7 Jul 08 Laptop stolen from locked rental car while employee on TAD.11 Jul 08 Government laptop stolen from locked government vehicle.14 Jul 08 Government laptop stolen from locked government vehicle.16 Jul 08 Government laptop stolen from guarded staging area.17 Jul 08 Personally owned vehicle stolen with government laptop in trunk.25 Jul 08 Government laptop stolen while on foreign travel.28 Jul 08 Personal thumb drive stolen from government <strong>of</strong>fice.30 Jul 08 Government thumb drive stolen from government <strong>of</strong>fice.31 Jul 08 Personal laptop stolen from locked personally owned vehicle.Lessons LearnedThe majority <strong>of</strong> these thefts could have been prevented had the safeguards below been followed. Refer to the naval message issuedby the DON CIO, “Safeguarding Personally Identifiable <strong>Information</strong> (PII)” <strong>of</strong> April 2007, available at www.doncio.navy.mil (search for “safeguardingPII”), for detailed guidance.• Storage <strong>of</strong> any form <strong>of</strong> PII is prohibited on personally owned laptop computers, mobile computing devices and removable storage media.• When removing portable electronic equipment from a government-controlled workspace for compelling operational needs, the device mustbe signed in and out, with a supervising <strong>of</strong>ficial designated in writing by senior leadership, when it contains 25 or more records containing PII.• Laptop computers and mobile computing devices and the data stored on removable storage media must be password protected. Refer toDoD Instruction 8500.2, "<strong>Information</strong> Assurance (IA) Implementation," <strong>of</strong> Feb. 6, 2003, available from the Defense Technical <strong>Information</strong> Center(DTIC) Web site at www.dtic.mil/whs/directives/corres/html/850002.htm.• Most thieves steal electronic equipment for its street value, but smart thieves know they can make significantly more money — if they canaccess privacy information to commit identity theft.• Automobiles are easy targets for thieves looking to make a quick buck. Locking your car is not sufficient protection for the contents inside oryour personally identifiable information. Do not leave PII in your car; this includes personal mail and your vehicle registration. Thieves especiallylike to target ball fields, shopping malls and health club parking lots because they know that vehicles will be unattended for lengthy periods. Ifyou must leave your laptop in the car, remove it from view. Be careful not to be seen locking a laptop in the trunk and park in a well-lit area.• A good theft deterrent is placing a warning label on laptop computers that specifies the laptop contains hardware security controls whichrender the machine unusable.• Encryption <strong>of</strong> data on all portable electronic devices is another good deterrent. If your laptop is not protected by the DON enterprise encryptionsolution, the use <strong>of</strong> WinZip s<strong>of</strong>tware is authorized. WinZip is available on most <strong>Navy</strong> Marine Corps Intranet desktops.• Train personnel on the security and safety risks associated with portable electronic equipment and the DON requirements for safeguardingPII.Additional laptop security information can be found on the DON CIO Web site at www.doncio.navy.mil (search on "laptop") and also onthe Federal Trade Commission Web site at www.ftc.gov.Steve Muck is the DON CIO privacy team lead.CHIPS October – December 2008 51

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!