Internet Security Initiative
The US government is considering an internet security initiative to improve cyberspace for everyone including individuals, businesses and government agencies who conduct business online. This initiative was announced by the Department of Homeland Security (DHS) and as mentioned aims to create a more secure system of online identification. This internet security initiative is called National Strategy for Trusted Identities in Cyberspace. There are a few components of this government security initiative that we could discuss including whether DHS is the appropriate US government Department to lead this initiative. There was actually a good article written by Mike Spinney who is a senior privacy analyst at the Ponemon Institute discussing this area posted here. There are three other areas that I would like to address with regards to National Strategy for Trusted Identities in Cyberspace. They include privacy laws, consumer awareness of the risks and best practices which I have been advocating for some time, as well as single sign on for select and related accounts. First, I think there are too many redundant, incomplete, and distributed privacy and security laws at the Federal and State levels. While the government is addressing this particular area through this internet security initiative, they must focus on the existing laws and think about consolidation and completeness of the laws. Although the redundancy of the laws is less of a concern, their completeness must be addressed which brings me to my next point. Consumer awareness and education regarding identity theft risks and best identity protection practices is not addressed in any of the current laws. There are no laws requiring companies which collect their customer non-public information as part of their business transactions to educate their customers regarding best identity protection practices and provide them with some type of identity theft awareness. And lastly, the existence of excessive number of online accounts, IDs and passwords just increases the online identity theft risks which should also be addressed. I think related accounts such as financial accounts from the same institution have a lot to gain from a single and strong identification and authentication mechanism. A good example is the Google strategy for linking and using the same access mechanism for its multiple user accounts. The excessive collection, retention and sharing of personal information is further addressed in my identity obesity concept and Identity Diet program. Return from internet security initiative to workplace information protection. |