SiliconBeat

Twenty four major federal agencies reported “that they had not yet installed encryption technology to protect sensitive information on about 70 percent of their laptop computers and handheld devices”, according to a survey conducted by the General Accountability Office during the third quarter of 2007.

The security gap exists despite passage of the Federal Information Security Management Act of 2002, which mandated mandates that agencies security programs to protect agency information and systems, and despite a policy issued by the Office of Management and Budget requiring federal agencies to encrypt all data on mobile computers and devices that carry agency data.

Personnel at the agencies reported to the GAO “uncertainty regarding the applicability of OMB’s encryption requirements for mobile devices, specifically portable media,” which included a requiring the use of products that have been approved by the National Institute for Standards and Technology cryptographic validation program.

While all agencies have begun efforts to deploy encryption technologies, according to the GAO, “none had documented comprehensive plans” to guide their deployment, including understanding federal guidelines regarding “appropriate technologies”, developing procedures for managing encryption technologies, and training users.

Bottom line: Federal information “may remain at increased risk of unauthorized disclosure, loss, and modification.”

May?!