Managing Records: Services for State Agencies: Newsletters

Newsletter: July 2009

Welcome to the July 2009 State Agency RMO newsletter!

In this issue:

CSCIC Information Classification Workgroup
Award Winning Colleagues
Launch of Empire 2.0
Security of Mobile Communication Devices

CSCIC Information Classification Workgroup

Karen Sorady, Cyber Security and Critical Infrastructure Coordination (CSCIC), is looking for interested agency staff to participate in a cross-agency workgroup that will attempt to apply data classification standards - as outlined in Cyber Security Policy & Standard PS08-001: Information Classification and Control (http://www.cscic.state.ny.us/lib/policies/documents/PS08-001-V1.1-December4,2008.pdf) - to General Retention and Disposition Schedule for New York State Government Records items. This policy, now a best practice, provides a framework for New York State agencies to identify their information assets; classify them based on the security principles of confidentiality, integrity and availability; and apply an appropriate set of controls.

Agencies who are interested in participating in this workgroup should contact Karen by emailing her at karen.sorady@cscic.state.ny.us

Award Winning Colleagues

Debra Kimok, current vice-chair of the SAA Records Management Roundtable and editor of The Records Manager roundtable newsletter, has been awarded the 2009 SUNY Chancellor's Award for her excellence in librarianship. Congratulations Debra!

Launch of Empire 2.0

In June, CIO/OFT announced the launch of Empire 2.0 – a New York State social media networking initiative designed to promote government participation, increase collaboration and expand the state’s ability to share information with social media users. This initiative is modeled after President Obama's strategy on open government. A number of state agencies have already begun to explore the implementation of Web 2.0 technologies. Recently CIO/OFT launched its own Twitter feed and Facebook page.

Find out more at the CIO/OFT website: http://cio.ny.gov/OFT/web2_0.htm and http://www.oft.state.ny.us/News/Press_web20.htm

Security of Mobile Communication Devices
Cybersecurity information and advice from our good friends at CSCIC.

From All This Functionality in One Device!

Mobile communication devices (includes Blackberrys, iPhones, smart phones in general) have become indispensable tools for today's highly mobile society. Small and relatively inexpensive, these multifunction devices can be used not only for voice calls but also text messages, email, Internet access along with stand alone applications similar to those performed on a desktop computer. A significant amount of personal, private and/or sensitive information may accumulate or be accessed via these devices. Additionally, some of these devices may allow you to access your home computer or your corporate network.

What Risks Do They Present?

While the devices offer many benefits and conveniences, they also pose risks to you and/or your
organization's security. As these devices continue to take on the characteristics of personal computers, they also inherit the same potential risks. Some of the primary risks include the following:

The portability of the device leads to a higher likelihood of loss of the device. Millions of mobile communication devices are lost each year.
When Bluetooth and/or wireless (not cellular) communications are enabled, these devices are subject to the risk of eavesdropping and "highjacking".
"Malware" available, that if installed on your device, can allow a perpetrator remote access to your device to listen and record all of your calls, send text messages to the perpetrator whenever you make or receive a call, read all of your messages, make calls on your behalf from your phone, access all of the information on your phone, trace your location and enable the speaker functionally on the phone to listen in on conversations even when the phone is not in use.
Sites purporting to offer "free games or ring tones" are major vectors for distributing malware.
While the reports of worms and viruses impacting these devices are relatively low, this is expected to increase in the future.

Despite the risks outlined above, many users do not understand how vulnerable their mobile device is or how to deploy important security settings and controls.

What Can I Do to Secure My Mobile Communication Device?
The following outlines steps you can take to protect your mobile communication device. Some of the steps are dependant upon the functionality of your device.

Use a password to access your device. If the device is used for work purposes, you should follow the password policy issued by your organization.
If the Bluetooth functionality is not used, check to be sure this setting is disabled. Some devices have Bluetooth-enabled by default. If the Bluetooth functionality is used, be sure to change the default password for connecting to a Bluetooth enabled device.
Do not open attachments from untrusted sources. Similar to the risk when using your desktop, you risk being exposed to malware when opening unexpected attachments.
Do not follow links to untrusted sources, especially from unsolicited email or text messages. Again, as with your desktop, you risk being infected with malware.
If your device is lost, report it immediately to your carrier or organization. Some devices allow the data to be erased remotely.
Review the security setting on your device to ensure appropriate protection. Be sure to encrypt data transmissions whenever possible.
Enable storage encryption. This will help protect the data stored on your device in the event it is lost or stolen, assuming you have it password protected!
Beware of downloading any software to your device. If the device is used for work, follow your organization's policy on downloading software.
Before disposing of the device be sure to wipe all data from it and/or or follow your organization's policy for disposing of computer equipment.

That’s it for this month! Remember that we want to hear from you. State Agency Services is here to help make your job easier by answering questions, doing site visits, and providing training.

Jennifer O’Neill
joneill@mail.nysed.gov
(518) 473-2112

Sarah Durling
sdurling@mail.nysed.gov
(518) 473-6803